MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da
SHA3-384 hash: 4225b69af35270c595b3666e0bdbbc975e09996e3e6b776c1a11c157a54d3a329d821355ea0658d17a0c9a94c832c7aa
SHA1 hash: 88df66db6f111c0194d474408ad1c4f31d1dd952
MD5 hash: acc05d7aeef2108a8a172bf2196dcb7f
humanhash: bakerloo-six-kilo-venus
File name:PENDING PAYMENT.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:742'912 bytes
First seen:2020-11-02 08:15:34 UTC
Last seen:2020-11-08 14:31:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:6iskcTP8oRXuqVbp8BkG3mCeUhkvkJ5d1O:RsfJuqRwlp1R
Threatray 876 similar samples on MalwareBazaar
TLSH 22F47DF67541D69BC81F107FF80F642043D4DF6E96F9428A43C5B62912BA7CA42BE48E
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/81744/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.4118.11620.5704.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/517975
Signature
.NET source code contains potential unpacker
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 308090 Sample: PENDING PAYMENT.exe Startdate: 02/11/2020 Architecture: WINDOWS Score: 100 64 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->64 66 Found malware configuration 2->66 68 Multi AV Scanner detection for dropped file 2->68 70 13 other signatures 2->70 7 PENDING PAYMENT.exe 6 2->7         started        10 bqhrQ.exe 5 2->10         started        13 bqhrQ.exe 4 2->13         started        process3 file4 44 C:\Users\user\AppData\Roaming\yHLGaTax.exe, PE32 7->44 dropped 46 C:\Users\user\AppData\Local\...\tmp432A.tmp, XML 7->46 dropped 48 C:\Users\user\...\PENDING PAYMENT.exe.log, ASCII 7->48 dropped 15 PENDING PAYMENT.exe 17 5 7->15         started        20 schtasks.exe 1 7->20         started        72 Multi AV Scanner detection for dropped file 10->72 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->74 76 Machine Learning detection for dropped file 10->76 78 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->78 22 schtasks.exe 1 10->22         started        24 bqhrQ.exe 2 10->24         started        26 bqhrQ.exe 13->26         started        28 schtasks.exe 13->28         started        30 bqhrQ.exe 13->30         started        signatures5 process6 dnsIp7 50 mail.ratllc.ae 162.241.253.123, 49728, 587 UNIFIEDLAYER-AS-1US United States 15->50 52 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.66.103, 443, 49727 AMAZON-AESUS United States 15->52 54 2 other IPs or domains 15->54 38 C:\Users\user\AppData\Roaming\...\bqhrQ.exe, PE32 15->38 dropped 40 C:\Users\user\...\bqhrQ.exe:Zone.Identifier, ASCII 15->40 dropped 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->56 58 Tries to steal Mail credentials (via file access) 15->58 60 Tries to harvest and steal ftp login credentials 15->60 62 3 other signatures 15->62 32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        42 C:\Windows\System32\drivers\etc\hosts, ASCII 26->42 dropped 36 conhost.exe 28->36         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-02 01:41:46 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=npbdztmgckzg7xtjypdebpvpfmmzpniidorbb233e34qhsalkxna._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2da02cb0f56579332322d544b18a172c8a3ea6f9506bc9e4a014943ebf174c56
AgentTesla
4059c5c31844e43226ec7b22e9f971aec27765e3822685e3a6b4af541fa6ced3
AgentTesla
755bcfb03ddf8019aca959a1a5f46f1e2a8b5e10cce049ce8b80e8f4daaaa143
AgentTesla
89413cdc62fe4db87e6879f9d43ce136b10dec2c241382bf8d42020b2f432b0c
AgentTesla
96827f6ab2dc0c8b0ad0c1f4bfaab1eca0e525a32c4b93e216e9d42f7c6b30be
AgentTesla
9b21a961dea4dd3f79e08cfc5bd13aca22c3ebfefc9d5c347713b4c492d66c1f
AgentTesla
a02fab001fe08ddb9a1ff1113714164bfb779c3c1829e0db5de65a9174f3af7c
AgentTesla
d5fa02045d60d623dacb74b1a719e571982f6a68ea7781c06f8d0ce104b98bd6
AgentTesla
d7105dfaf2690af5ecb82d31c891c8b6e36af889ddf4c10af513f4d0efd2d073
AgentTesla
e582696b2f3c980a6d81be401fc5da4c24a4b0c490ff6764516a0aa3e3aae23b
AgentTesla
+ 866 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201102-6qcpy792dj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da
MD5 hash:
acc05d7aeef2108a8a172bf2196dcb7f
SHA1 hash:
88df66db6f111c0194d474408ad1c4f31d1dd952
Link:
https://www.unpac.me/results/188a68b3-1a53-4801-96b2-1dfd718ef0c6/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/188a68b3-1a53-4801-96b2-1dfd718ef0c6/
SH256 hash:
739b9c1797a7e3e37a6db68b1970c01bf8511814629ee2c324458f2703b0172f
MD5 hash:
8195b97d775ee674c2a0639a5f3a718a
SHA1 hash:
2fb8e4750e3df739f4d26a6172b4b265feb64b18
Link:
https://www.unpac.me/results/188a68b3-1a53-4801-96b2-1dfd718ef0c6/
SH256 hash:
a3dc28aca4d0ebaf9aa0ba016e9dfb341197201a661de45e686b1c24b542799f
MD5 hash:
f9eee91e451e5a02f428a40597a35528
SHA1 hash:
e597d91186933e716429e3f06a8c203d08a10761
Link:
https://www.unpac.me/results/188a68b3-1a53-4801-96b2-1dfd718ef0c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b8b1c576766634f53cb607059a9ab5a7992d8dd7c61b6019a2f89a006e1c9cd7

AgentTesla

Executable exe 6bc23ccd8612b26fde69c3c640beaf2b1997b5081ba210eb7b26f903c80b55da

(this sample)

  
Dropped by
MD5 cb1a7fd54613dc21fb376cf05d6535fd
  
Dropped by
SHA256 b8b1c576766634f53cb607059a9ab5a7992d8dd7c61b6019a2f89a006e1c9cd7
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/81744/

Comments