MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c
SHA3-384 hash: 54d817327320aee7d79b5be7361245261f205aded2d32297799b3e94f27ed3a22f43302e09b284dcc259678190b514dc
SHA1 hash: 7828419dfef411764b9cb0903b16c522fec829d7
MD5 hash: adbf6cf5ba5165765889dacd1924ab56
humanhash: sink-oregon-four-march
File name:Ödeme Emrinin Kopyası.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:815'104 bytes
First seen:2022-02-21 13:08:21 UTC
Last seen:2022-02-21 15:08:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:WEOby0chFFQWN0BxTgESYTvRAzdncanWq0CzQ4y+5T0UhUH433FUsYXXbpmXp:AbHchFS+4RWhfCU1p33qsOroXp
Threatray 15'842 similar samples on MalwareBazaar
TLSH T18905D0DC29BB01FAF326CEFD5CDCE5B0CA79A6212504F4BA78DA1F420744B4499D2279
Reporter JAMESWT_WT
Tags:AgentTesla Emrinin exe Kopyası

Intelligence

File Origin
# of uploads :
2
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c.zip
Verdict:
Malicious activity
Analysis date:
2022-02-21 14:51:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e1e7b31f-d823-4b6d-a95b-33e1ade1a846

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242964/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.44053.1829.10047.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62138ef7a2660f3bb91b1c77/reports/866423f3-3e9a-4ff4-b03f-fe48b4388e0a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea2af72b-d470-4905-944c-94ada8d02d7f
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-21 13:09:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
17c6884e69ed53cb079dc2504872451d5e9977876d40074877d4431322ec26df
AgentTesla
2aa0b322a52bae7a4dcdf5f16e228bd20a77849d73e14fde55ff01511bd491f8
AgentTesla
34302ae724db13394bc7e2e06ff9b46b319c74975f4bef78cb97d1e16aff460f
AgentTesla
5b8c260a34b8c013822404843943a456144cdd55a2274597ba71beca6c8f330b
AgentTesla
6d9cffad54a9be6a0bf146b1a4cb1257d432c133a8dd5d8379f7b791833a695b
AgentTesla
80565e8afbde4c0b5d1b3c4662145ee1e36880eda1ef85c429f76e495212a1ba
AgentTesla
c8262f980bc426f0690a7007910673568aa2595af3d8d1d597c528942850f438
AgentTesla
f4b72b6ee21d487b8b7ec716a9e8d00c1576120449b189e2d89aef4503808283
AgentTesla
+ 15'832 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220221-qdstssace4/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
f4c6d0b3ff8dd1100a6dd10550936f1207eb9c29b7cd42589718a9a4f3695386
MD5 hash:
84ec08ab0bc4e88c3cbaa0d211044685
SHA1 hash:
8261c0e369b15c500a4bc669e94086217af28a5e
Link:
https://www.unpac.me/results/d08501b3-3e8c-4f54-a872-2c8d34d3dcce/
SH256 hash:
e33254e2ad4d279914a29450f98d1750a9f513fc8ddb853e0dd8346b805faa43
MD5 hash:
b597cce7bfc65e56fa69ebb7f413a33f
SHA1 hash:
7ee40df5ac783432e7c9f7be4f7ed1f286345d58
Link:
https://www.unpac.me/results/d08501b3-3e8c-4f54-a872-2c8d34d3dcce/
SH256 hash:
0c45f2f3273c56f14f78e7a2102060316dc151694870af31e20512398f9dd62e
MD5 hash:
99c88096328ba6b8e7a59c11fb0efbaf
SHA1 hash:
087c9d0d395a6ae04efaa421b54364642c886201
Link:
https://www.unpac.me/results/d08501b3-3e8c-4f54-a872-2c8d34d3dcce/
SH256 hash:
051d84018f563dde43d8c343dbfae81b9fe40507652be664ab48ac13dc2e5fbb
MD5 hash:
d6965ca13874b05f2519702d5795a1a6
SHA1 hash:
038b67121f44bf7b27e09734a43046c6e6cfd40c
Link:
https://www.unpac.me/results/d08501b3-3e8c-4f54-a872-2c8d34d3dcce/
SH256 hash:
6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c
MD5 hash:
adbf6cf5ba5165765889dacd1924ab56
SHA1 hash:
7828419dfef411764b9cb0903b16c522fec829d7
Link:
https://www.unpac.me/results/d08501b3-3e8c-4f54-a872-2c8d34d3dcce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6b2b7fcb8171b3701611515a82b2ac37c9a3c7cbe2d2b2a80b7212cb3402392c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/osipov_ar/status/1495385224204767232?s=20&t=HnzXuARSlL02n1hwzqMP-g
Cape
Cape
https://www.capesandbox.com/analysis/242964/

Comments