MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c4e1f8d9d65712d50dd63f5ef8bce5c788afcec567f735e035f068d8c859341. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c4e1f8d9d65712d50dd63f5ef8bce5c788afcec567f735e035f068d8c859341
SHA3-384 hash: ae363495b65f47f593e46f19d65333f27242b538fa1c8454a323f41e0b46cb0a131994a9e7fbe50c17218750644440ca
SHA1 hash: 8d93b01450fb52f7b12187b17bf5c318fb79d858
MD5 hash: 554be553969bba38ee71b2abe52ee6c8
humanhash: berlin-victor-undress-aspen
File name:New Shipment nvoice No..exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:914'944 bytes
First seen:2020-09-21 11:02:14 UTC
Last seen:2020-09-21 11:53:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 27d4dacfac04a1a81556912c5945ad85 (6 x AgentTesla)
ssdeep 24576:BZD1cQJRl7oN0RhBIVduQVo28zUOR93hrZgQV/8:LJR+17Vo28d3hZ8
Threatray 561 similar samples on MalwareBazaar
TLSH E215075275F85823EA1E907E8B073FF5A8917AC0E53F579A1FF0E8294AB47C12D18187
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/471171
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops VBS files to the startup folder
Found malware configuration
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Drops script at startup location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 288021 Sample: New Shipment nvoice No..exe Startdate: 21/09/2020 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Detected unpacking (changes PE section rights) 2->45 47 7 other signatures 2->47 7 New Shipment nvoice No..exe 2->7         started        10 wscript.exe 1 2->10         started        process3 signatures4 57 Writes to foreign memory regions 7->57 59 Allocates memory in foreign processes 7->59 61 Maps a DLL or memory area into another process 7->61 63 Queues an APC in another process (thread injection) 7->63 12 New Shipment nvoice No..exe 15 2 7->12         started        16 notepad.exe 1 7->16         started        18 New Shipment nvoice No..exe 10->18         started        process5 dnsIp6 35 us2.smtp.mailhostbox.com 208.91.199.223, 49758, 49761, 587 PUBLIC-DOMAIN-REGISTRYUS United States 12->35 37 elb097307-934924932.us-east-1.elb.amazonaws.com 184.73.247.141, 443, 49757 AMAZON-AESUS United States 12->37 39 2 other IPs or domains 12->39 65 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->65 67 Tries to steal Mail credentials (via file access) 12->67 69 Drops VBS files to the startup folder 16->69 71 Delayed program exit found 16->71 73 Writes to foreign memory regions 18->73 75 Allocates memory in foreign processes 18->75 77 Maps a DLL or memory area into another process 18->77 20 New Shipment nvoice No..exe 2 18->20         started        24 notepad.exe 1 18->24         started        signatures7 process8 dnsIp9 29 54.225.169.28, 443, 49760 AMAZON-AESUS United States 20->29 31 192.168.2.1 unknown unknown 20->31 33 4 other IPs or domains 20->33 49 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->49 51 Tries to steal Mail credentials (via file access) 20->51 53 Tries to harvest and steal ftp login credentials 20->53 55 Tries to harvest and steal browser information (history, passwords, etc) 20->55 27 C:\Users\user\AppData\Roaming\...\needs.vbs, ASCII 24->27 dropped file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c4e1f8d9d65712d50dd63f5ef8bce5c788afcec567f735e035f068d8c859341/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-09-21 09:43:44 UTC
File Type:
PE (Exe)
Extracted files:
55
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nrhb7dm5mvys2ug5mp267c6olr4iv7hmkz7xgxqdl4di3defsnaq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
125203c92ab4db76de740b9cb2ce5908bbf6ee86864855a4903e2d5c17953ad1
AgentTesla
277848fe676c925becc15a494855ccbc42ee8e2e88cf61144d7de703c82250a0
AgentTesla
37a4202e64f88ef928f46cdb05653527a1201aaffd431022eececff19348515b
AgentTesla
3a8afa181b83a479c7c476791061dd4a7df56a59e21bcb72f0c8a32d76b66d5b
AgentTesla
8bc0a287e7c20feba8e4006c7683503eeabfa9fddfb14c8f80d8a92ef09b6fd6
AgentTesla
93d22d39577ab983c75badd9019b57420a4e2bfc300d6a37d90885d823396058
AgentTesla
b98ed6a71c93bc3722112643bea2bbe8767e016d807e0463266ee2fd47ad9e80
AgentTesla
c1c58c6918062b4e641a924b19712a015d1a74b184e3fb19e444216edbdfcedd
AgentTesla
c3372683261b447261620810696af6f9f7250ec7022b82c81895051039effcbd
AgentTesla
f03aa3254a964c676c99d1b2e96ef0e84d4c81e3b0885debf8e49f731c3d4779
AgentTesla
+ 551 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200921-dyvp7rtlm2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c4e1f8d9d65712d50dd63f5ef8bce5c788afcec567f735e035f068d8c859341

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 791a1952802fb90ab83d9644b7c34783e2081144ef9511476060abe50b867f3c

AgentTesla

Executable exe 6c4e1f8d9d65712d50dd63f5ef8bce5c788afcec567f735e035f068d8c859341

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 791a1952802fb90ab83d9644b7c34783e2081144ef9511476060abe50b867f3c
Cape
Cape
https://www.capesandbox.com/analysis/22/

Comments