MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58
SHA3-384 hash: 65685a82da5ec8a35abb1388ea8f6abc1657b39fa587a9efc4256bc40fa6434367b28ae0b71e9357b61d479602a06c51
SHA1 hash: 6f408b45b57cd1d193465c95456d1f4b64a83f0b
MD5 hash: ae50583b728ab7f6d54fc70b23fdf234
humanhash: five-thirteen-five-fish
File name:DHL-#AWB130501923096PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:744'448 bytes
First seen:2020-11-18 11:44:22 UTC
Last seen:2020-11-18 14:06:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:7yrEmxXGqZnQM7WEx4pwZJXe+O8dQczIUjSXQ4V9NK3/:7GT6M7WE0uJXeD8SczhQQy23
Threatray 1'457 similar samples on MalwareBazaar
TLSH E0F4D039637DAF62E0BD8B7B88A05410A3F5EC428263C52F7DE8F59A19B5FE81131507
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/540977
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 319588 Sample: DHL-#AWB130501923096PDF.exe Startdate: 18/11/2020 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Multi AV Scanner detection for dropped file 2->35 37 Sigma detected: Scheduled temp file as task from temp location 2->37 39 9 other signatures 2->39 7 DHL-#AWB130501923096PDF.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\Roaming\PfuxZr.exe, PE32 7->19 dropped 21 C:\Users\user\...\PfuxZr.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmpD7CD.tmp, XML 7->23 dropped 25 C:\Users\...\DHL-#AWB130501923096PDF.exe.log, ASCII 7->25 dropped 41 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->43 45 Injects a PE file into a foreign processes 7->45 11 DHL-#AWB130501923096PDF.exe 15 8 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 mail.privateemail.com 198.54.122.60, 49766, 49767, 587 NAMECHEAP-NETUS United States 11->27 29 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.83.248, 443, 49764 AMAZON-AESUS United States 11->29 31 2 other IPs or domains 11->31 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->47 49 Tries to steal Mail credentials (via file access) 11->49 51 Tries to harvest and steal ftp login credentials 11->51 53 Tries to harvest and steal browser information (history, passwords, etc) 11->53 17 conhost.exe 15->17         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 02:51:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqlsciw3ll2ux3dpdjrfkfu77fo55phhrpcvbakmoapppytgj5ma._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0fbe3c1eaa360c2e44eba7d89d9c0383d30d1a4fc80a7cecb9bb0b81c6f4c6aa
AgentTesla
13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
AgentTesla
14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
AgentTesla
23cb1d198cca93539a5bdbf18ce44ae3692be0ae968b5fe55e3794ec481aa1cf
AgentTesla
38d67003a3e33b0ff622758a04b631ac24d0f55f04c007834fd61bf8c2e9074d
AgentTesla
5952cc403a58eab272b199a6f39c35bfadf8feeafbadc1a3d30a68e01e93b7ae
AgentTesla
67377c6c2259974077c2b7476f77823862ed6d5c6ce95c579e101b3d0a81b71e
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
ba495069a1b601a12f32f6e346dfe60958f73caa0048fb702e357fee17d58d54
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
+ 1'447 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201118-29ymcf35re/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
SH256 hash:
940a87b281104790ed92f7be70b03b230bc08bb64ad7429a062be72901639b44
MD5 hash:
feeaf5fc687216c3e08b461fde115143
SHA1 hash:
695e825795a447ae1132352ac155ed47cb9dcd70
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
SH256 hash:
44972f1292cead4a36b6e9b63599eaab38c43e7c515dacebcfee86684eaf3f81
MD5 hash:
2cca1dba8f010aa5987751b598288222
SHA1 hash:
8f13a04f39c45b182b7d7f4ce3d785b61143348f
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
SH256 hash:
36943c1cab811a45ae56dba75b8f4bb064caedb5be320a19643a0f38dcacbfae
MD5 hash:
a82e7a04e7ddc8edf62b26bfb6e8b497
SHA1 hash:
98831ee2737c327866f6ca3f6bc11d07c051da1b
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
SH256 hash:
6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58
MD5 hash:
ae50583b728ab7f6d54fc70b23fdf234
SHA1 hash:
6f408b45b57cd1d193465c95456d1f4b64a83f0b
Link:
https://www.unpac.me/results/411b4ddb-6a51-4549-bb0a-b58bb04b5226/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36

AgentTesla

Executable exe 6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 23157428caf5d09713a7e74208c3a0fdd17be488dd889a668bb1f1e49fcd1a36
  
Dropped by
SHA256 d4e6a012785ef235bbf24e16a097f992b4d4d7ef4858df1f3f5af5354f7cc9bc

Comments