MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541
SHA3-384 hash: 31293481cc7a193e573752f6d3e557cdce0145ddcc09c395399d3617d13f58e43532e02e7cdc867570c410be3417810a
SHA1 hash: ecec1c4b32f1c4b7c36a9e1288ca6fc2e0c37e65
MD5 hash: af3afdb900624af15bd0984c7c6e236f
humanhash: minnesota-magazine-spring-harry
File name:Urgent Price request P.O 1672891FTN.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'340 bytes
First seen:2023-02-08 11:24:10 UTC
Last seen:2023-02-08 12:38:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep 6144:/Ya6q0fMteJiHLKzBBF+JmsGhO5nuJLudiBte7SSjxzBJd2KowUylh3eo0sgVAct:/YMztbH+BBFsms8I+rngJUyP0sgh
TLSH T110842301A774E266C4F257B28E2B1BF21E6219197C90C26F0708996F3C76BC1E71D7A6
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
191
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Urgent Price request P.O 1672891FTN.exe
Verdict:
Malicious activity
Analysis date:
2023-02-08 11:24:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4886dfa5-0af5-4e0b-aebb-6d140e86d07d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/361926/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65392739.1005.8764.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/66507/overview
Behaviour
MalwareBazaar
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63e38690696b2d972575a25f/reports/0f9544bf-41b7-4e20-affa-1352f1a4897b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38055c71-deed-4430-a0f5-c9ed3539f2e0
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1168712
Signature
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 801492 Sample: Urgent Price request P.O 16... Startdate: 08/02/2023 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected AgentTesla 2->48 50 Machine Learning detection for sample 2->50 7 Urgent Price request P.O 1672891FTN.exe 19 2->7         started        10 enwscx.exe 2->10         started        13 enwscx.exe 2->13         started        process3 file4 28 C:\Users\user\AppData\Local\...\exjjiczbi.exe, PE32 7->28 dropped 15 exjjiczbi.exe 1 2 7->15         started        58 Multi AV Scanner detection for dropped file 10->58 19 WerFault.exe 4 10 10->19         started        21 WerFault.exe 10 13->21         started        signatures5 process6 dnsIp7 30 C:\Users\user\AppData\Roaming\...\enwscx.exe, PE32 15->30 dropped 36 Multi AV Scanner detection for dropped file 15->36 38 Detected unpacking (creates a PE file in dynamic memory) 15->38 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->40 42 3 other signatures 15->42 24 exjjiczbi.exe 15 2 15->24         started        32 192.168.2.1 unknown unknown 21->32 file8 signatures9 process10 dnsIp11 34 discord.com 162.159.136.232, 443, 49696 CLOUDFLARENETUS United States 24->34 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->52 54 Tries to steal Mail credentials (via file / registry access) 24->54 56 Tries to harvest and steal browser information (history, passwords, etc) 24->56 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-02-07 08:22:16 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngy5ymgokkqyfgz7zmahdlfvpdfhfjf4rdx4hvwo4vred4suwvaq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230208-nh98jahh9x/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://discord.com/api/webhooks/1060757502565818479/57pRuqMAyuA5m2WNQ9ciG7gqRMMkk4SpvWAVFv8yKmB88JGZW6jK8C7Jd68WDI1xLxvb
Unpacked files
SH256 hash:
b055b54bb15620ddc0a04a8b984b4fa1c66ed09b24c33ddd94763fc5e09df94a
MD5 hash:
2d3a71c5e5098c33188dc5611f0b5229
SHA1 hash:
f65f2ae8d2b6dbc5136c13b5c20b610e2e64f66a
Link:
https://www.unpac.me/results/6113f822-7048-4771-8e1c-f8edd26f20e4/
SH256 hash:
236b4c73c572a3b7a738aec6ce3d49961873269aa43e6a831448a3ee26a3f7a0
MD5 hash:
a38b5641968109193f1890d48f15fb97
SHA1 hash:
b23978401200e9f427aa83c87d786653c321e084
Link:
https://www.unpac.me/results/6113f822-7048-4771-8e1c-f8edd26f20e4/
SH256 hash:
69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541
MD5 hash:
af3afdb900624af15bd0984c7c6e236f
SHA1 hash:
ecec1c4b32f1c4b7c36a9e1288ca6fc2e0c37e65
Link:
https://www.unpac.me/results/6113f822-7048-4771-8e1c-f8edd26f20e4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69b1dc30ce52/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 3b81d0340e7eb9ad652fbaec10a8392027156a5fb7eb2c6bb3f4d8b851602f99

AgentTesla

Executable exe 69b1dc30ce52a1829b3fcb0071acb578ca72a4bc88efc3d6cee56241f254b541

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 3b81d0340e7eb9ad652fbaec10a8392027156a5fb7eb2c6bb3f4d8b851602f99
Cape
Cape
https://www.capesandbox.com/analysis/361926/
  
Dropped by
MD5 32e51fa62a4a42996e34d4a44b0bcd8b

Comments