MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8
SHA3-384 hash: 0a6de4a9513d7eef645aab24926e31f1b54160271490f309085a97655f0cf2f16c9ec3571276c1f03b8e6ebe97c2e6e5
SHA1 hash: 8c11335798e398ec9b9acc6a0e3fe836ce6c2558
MD5 hash: f22203ad19d049250d5abe9f9eeaa741
humanhash: kansas-sixteen-one-louisiana
File name:CIPL.xlsx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:717'312 bytes
First seen:2023-09-27 06:19:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:Q35+UwNvMMMDMMMYCUCBmulcuArvkPAoxoj2LlrjGSEYTFMtntGGzGtGGGlGtGGt:BvMMMDMMMYCFmJuAbk44oj2xjGYF
Threatray 1'252 similar samples on MalwareBazaar
TLSH T13FE405F521F9DE19FC10ABFFC3C7A4004BBB6A70C65694097B31678E1DB3E82664A518
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon f0f0e84dcde4e4f8 (17 x AgentTesla, 4 x AveMariaRAT, 4 x RemcosRAT)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
CIPL.xlsx.exe
Verdict:
Malicious activity
Analysis date:
2023-09-27 06:21:18 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/1f48845a-d721-4acc-aa6f-3e0555c0e959

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/451447/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.6121.15714.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file
Using the Windows Management Instrumentation requests
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin masquerade packed
Link:
https://www.filescan.io/uploads/6513c9950870810f018776fd/reports/35e19889-9d12-4c09-93ea-bcd1cc419a56/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/04e00a86-3d7e-42d0-9783-7328e6215d2f
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1314973
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large strings
Contains functionality to log keystrokes (.Net Source)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1314973 Sample: CIPL.xlsx.exe Startdate: 27/09/2023 Architecture: WINDOWS Score: 100 58 Malicious sample detected (through community Yara rule) 2->58 60 Sigma detected: Scheduled temp file as task from temp location 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 7 other signatures 2->64 7 CIPL.xlsx.exe 6 2->7         started        11 PECNedZuKG.exe 5 2->11         started        13 newapp.exe 2->13         started        15 newapp.exe 2->15         started        process3 file4 46 C:\Users\user\AppData\...\PECNedZuKG.exe, PE32 7->46 dropped 48 C:\Users\user\AppData\Local\...\tmp622E.tmp, XML 7->48 dropped 78 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->78 80 Uses schtasks.exe or at.exe to add and modify task schedules 7->80 82 Writes to foreign memory regions 7->82 17 RegSvcs.exe 17 4 7->17         started        22 RegSvcs.exe 7->22         started        24 backgroundTaskHost.exe 7->24         started        34 2 other processes 7->34 84 Multi AV Scanner detection for dropped file 11->84 86 Machine Learning detection for dropped file 11->86 88 Injects a PE file into a foreign processes 11->88 26 RegSvcs.exe 11->26         started        28 schtasks.exe 11->28         started        30 conhost.exe 13->30         started        32 conhost.exe 15->32         started        signatures5 process6 dnsIp7 50 api4.ipify.org 104.237.62.212, 443, 49779 WEBNXUS United States 17->50 52 api.ipify.org 17->52 44 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 17->44 dropped 66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->66 68 Tries to steal Mail credentials (via file / registry access) 17->68 70 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->70 36 WerFault.exe 23 9 17->36         started        72 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 22->72 74 May check the online IP address of the machine 22->74 54 173.231.16.77, 443, 49782 WEBNXUS United States 26->54 56 api.ipify.org 26->56 76 Tries to harvest and steal browser information (history, passwords, etc) 26->76 38 WerFault.exe 26->38         started        40 conhost.exe 28->40         started        42 conhost.exe 34->42         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2023-09-26 17:44:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=njtrzimkj4brsadsngek2m5dm5p4jr4ncp2bhakbuzaykkkiy74a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
39bf9b51b8b6e1b743e3e30d835101292ddb0c1e19d8748eb4959dc4e947a479
AgentTesla
445e78195ac6fda213fe26c8263f5362d0f3f61ff4d5f11e9c1293298a1b422f
AgentTesla
7576e8a511b554c10cbb9af84a0e764f2c22e05bbeb04747ffc773aa39e0590d
AgentTesla
997dd0b02e8c585b5ba3b70bb076aff6e91c35d7143ade955097498f27e501e7
AgentTesla
ce56ba6e7d6693cf8b2110b6ce1789f9a38669af8e17c30ff83e9fec9372c372
AgentTesla
d1c30d9e24b4916ac3fdfe60b89836014c2b24e15c5729088fc770567e315693
AgentTesla
e3bb4be5d6f18e8fbec6ea1a30572f9bf6bff8764fe54e0285b5ffee096683a5
AgentTesla
+ 1'242 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230927-g3rtcsgd5v/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Unpacked files
SH256 hash:
094709b9d966333f592c4232a2c1deb58806b07d951514dd365413caeb04558f
MD5 hash:
1ce00731b3a3d5d0729b5ae43960f6a6
SHA1 hash:
d7cbc2410aa3368d9c56c53fe22f4f1f121b2aeb
Link:
https://www.unpac.me/results/71eca58b-d1b9-45f0-a878-0b51f78ef422/
SH256 hash:
254639211233cf6c2ea3ff3131e18bd8d1bf18442d21e0821f28d6c2ce4b2569
MD5 hash:
b8d8e21756e20da17b4bc9ccffb04d34
SHA1 hash:
891e6cef74ba6b3dce880f895462c5762e83a2b1
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/71eca58b-d1b9-45f0-a878-0b51f78ef422/
SH256 hash:
f3f7b59a1b5782c6df5e129ac62d27473b638a10820929cf6c6b07b84594bae8
MD5 hash:
9824cc1c32974d27e818c969b139d1f6
SHA1 hash:
4158f644fbea9c4791a3258be782f2c39ade72f3
Link:
https://www.unpac.me/results/71eca58b-d1b9-45f0-a878-0b51f78ef422/
SH256 hash:
6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8
MD5 hash:
f22203ad19d049250d5abe9f9eeaa741
SHA1 hash:
8c11335798e398ec9b9acc6a0e3fe836ce6c2558
Link:
https://www.unpac.me/results/71eca58b-d1b9-45f0-a878-0b51f78ef422/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6a671ca18a4f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 47fb97e113775dc39d51ed864a2aac2f131b8bc3778821cea5f8a9e01c9d4e7e

AgentTesla

Executable exe 6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 47fb97e113775dc39d51ed864a2aac2f131b8bc3778821cea5f8a9e01c9d4e7e
Cape
Cape
https://www.capesandbox.com/analysis/451447/
  
Dropped by
MD5 af6b8315e2a0825869ddb10291f0a47b

Comments