MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98
SHA3-384 hash: c4e9106bb4e30c49fa975408b33ff16bfb04ea6826f0e6ca1a5d472b57498834ed3b50422749179f32b54bf9f808703a
SHA1 hash: 870247a4371c67a0dd41f89e755be28204c41eca
MD5 hash: e40e8ff238b70f45bdf02fce8e5a8e35
humanhash: lemon-william-jupiter-pasta
File name:PURCHASE ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'003'520 bytes
First seen:2023-03-02 10:43:55 UTC
Last seen:2023-03-02 13:47:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:Z+xOZRahdu3GIXcNu7qCJd/YScCjKwPDL:kIMd/IsNu7NPcEb/
Threatray 98 similar samples on MalwareBazaar
TLSH T1DC257CC637BCD122F4DBA572061522CA3A29F997B216F13BA737BB158200BFF7685540
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER.exe
Verdict:
Malicious activity
Analysis date:
2023-03-02 10:45:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7692878a-1687-4844-ba7f-d18e70b5fed9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371087/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen3.27084.966.7812.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a file in the %temp% directory
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed strictor
Link:
https://www.filescan.io/uploads/64007df4bbedb8176ff22beb/reports/5ccc8f67-0dd7-4571-98eb-7628520bfc90/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54d1c501-aae3-4219-aefc-6a4537b0e49f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185614
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818480 Sample: PURCHASE ORDER.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 58 Snort IDS alert for network traffic 2->58 60 Multi AV Scanner detection for domain / URL 2->60 62 Antivirus detection for URL or domain 2->62 64 7 other signatures 2->64 7 PURCHASE ORDER.exe 7 2->7         started        11 sEijUBeXi.exe 5 2->11         started        13 yGbzOMp.exe 2->13         started        15 yGbzOMp.exe 2->15         started        process3 file4 46 C:\Users\user\AppData\Roaming\sEijUBeXi.exe, PE32 7->46 dropped 48 C:\Users\...\sEijUBeXi.exe:Zone.Identifier, ASCII 7->48 dropped 50 C:\Users\user\AppData\Local\...\tmpD206.tmp, XML 7->50 dropped 52 C:\Users\user\...\PURCHASE ORDER.exe.log, ASCII 7->52 dropped 78 Adds a directory exclusion to Windows Defender 7->78 17 RegSvcs.exe 2 4 7->17         started        22 powershell.exe 21 7->22         started        24 powershell.exe 19 7->24         started        26 schtasks.exe 1 7->26         started        80 Multi AV Scanner detection for dropped file 11->80 82 Machine Learning detection for dropped file 11->82 28 RegSvcs.exe 11->28         started        30 schtasks.exe 11->30         started        32 conhost.exe 13->32         started        34 conhost.exe 15->34         started        signatures5 process6 dnsIp7 54 mail.bosphoreqroup.com 162.241.27.28, 49695, 49696, 587 UNIFIEDLAYER-AS-1US United States 17->54 56 192.168.2.1 unknown unknown 17->56 44 C:\Users\user\AppData\Roaming\...\yGbzOMp.exe, PE32 17->44 dropped 66 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->66 68 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->68 70 Tries to steal Mail credentials (via file / registry access) 17->70 72 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 17->72 36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 26->40         started        74 Tries to harvest and steal browser information (history, passwords, etc) 28->74 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->76 42 conhost.exe 30->42         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 10:36:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
21 of 25 (84.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n423jcnlpej5ccib7sm5mmovviyq34wbujggp2e5tez3l2tahwma._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06cd81198082d8438712ab708be1ef02d57bfc3a5bc65553aa5be350f0cd6081
AgentTesla
478dba764af2f0d8179f62518b9d675cec897722b4bc9dc75b5bf66cbca0b9a0
AgentTesla
a1676f45b62888ee70a1de35cd144ff7e025527b1ff75d1ae1dd412ad5cc7de5
AgentTesla
a46f5213113d894ca3e9dc9ec6d66ab9e46253d05d08a035a0e2e817744047a2
AgentTesla
b2529986a8973dcb1028129512298ae4deffdc5a1e2ac225aa7f54fc44f6830a
AgentTesla
b8a5c75c1d6e7d0db7108bdace410c3eb76455a5458f885abb52ff543d5bcaf9
AgentTesla
b97359d81ff705942e503b8a9636d0260a6de0d6c7d00fe6a104e6413eebf5b6
AgentTesla
c551529018bda5ce4f1f7c2fbbebad88a1544151676521feb0bb5fcacc4a48be
AgentTesla
c89d8cc3c52b8b56669289df85876ab472b3451e459f18cfd35d7f74e24dc8fd
AgentTesla
efd5a5231f12bcaa48f701b82ff32314b313e5484fabe8596a7ce9283a08f71c
AgentTesla
+ 88 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230302-mstsvscb7t/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
AgentTesla
Unpacked files
SH256 hash:
d8ec03c34a5f3bd93effeafc2e078ade5df75d468dae5208937c69be4fecfe7f
MD5 hash:
cd4b7952d18e1459bae379e5da7f6afb
SHA1 hash:
e09367a20c19427dae20b53cbe761d1b21272c36
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
SH256 hash:
924147f3673617b76ec4ddaea8266723acac5960dda30aaf6c49b0840d7e85bc
MD5 hash:
23c7440547f19ca4f72c4851fa4ebee6
SHA1 hash:
63174cb7a0d9c83552f1aaff441073746eef5d59
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
SH256 hash:
a46998f03ca372f55fec7e4d4de698c5d128eea00502975bf7c337b0d3372640
MD5 hash:
2f5d6edb1b87947812a05ab362fe9a27
SHA1 hash:
4a48608fa247541aae9d2d31b85a2d6c9d191f82
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
SH256 hash:
2a13b20bc451854bce8a2c81318e929082740a55692837d97f4442b1cd1f25d1
MD5 hash:
949b2980d991d7433e04b8a19dd5f966
SHA1 hash:
2b85ac498cb56d8d65073247ba66700f2a20ff16
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
SH256 hash:
99659fa223e7c1e16928a6ae5a311024b9ad842be8d9588d172f8fb74d6d52c3
MD5 hash:
b3a4365386e0613dce785542e2eee51f
SHA1 hash:
0423cb4c56262cf23eb1593917a09c14ff894fa4
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
SH256 hash:
6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98
MD5 hash:
e40e8ff238b70f45bdf02fce8e5a8e35
SHA1 hash:
870247a4371c67a0dd41f89e755be28204c41eca
Link:
https://www.unpac.me/results/30af3a35-7fa2-48b4-86e9-1be800dd71a8/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6f35b489ab79/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b2ff741799f3ef00d68480bad005f2d31b631279e9e7be33b8b169e78bec239e

AgentTesla

Executable exe 6f35b489ab7913d10901fc99d631d5aa310df2c1a24c67e89d9933b5ea603d98

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 b2ff741799f3ef00d68480bad005f2d31b631279e9e7be33b8b169e78bec239e
Cape
Cape
https://www.capesandbox.com/analysis/371087/
  
Dropped by
MD5 7e6e80e5003bcba11ecd62f2f4b88e89

Comments