MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7493353a29f1591f88e0013c3aa0fb8810f49be33b111e6c5f1e462b16644c45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	7493353a29f1591f88e0013c3aa0fb8810f49be33b111e6c5f1e462b16644c45
SHA3-384 hash:	8b9ad568ae4bd77edbca0979da716d6b48567cc7afa3e9c77be952e5abd826969427ff38689e9f34e12a845db15fcfdb
SHA1 hash:	5e8300e05e7e0073929152305f871a2a18cc98b3
MD5 hash:	e9f825ea566bba1f1869b39ed4ce7e6a
humanhash:	lamp-romeo-shade-grey
File name:	Payment Receipt.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	573'952 bytes
First seen:	2020-10-14 15:39:54 UTC
Last seen:	2020-10-14 17:01:38 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:3IDrl6lRlJ9JthFRFpN5dxFRlpdptBlRFJHpHY700kAgEE4Y00wAngYoUEAgkk45:d3IxSZRrWmb
Threatray	616 similar samples on MalwareBazaar
TLSH	D4C429197A05DF74F41A55B041C2A1F20303EEDC2952A13A7FD2FE9FA97364909DEE82
Reporter	abuse_ch
Tags:	exe NanoCore

abuse_ch

Malspam distributing NanoCore:

HELO: success.herosite.pro
Sending IP: 23.111.148.162
From: sells@diamondeng.in
Subject: Payment Receipt
Attachment: Payment Receipt.rar1 (contains "Payment Receipt.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/70914/

Detection(s):

SecuriteInfo.com.BackDoor.SpyBotNET.25.16124.12173.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Unauthorized injection to a recently created process

Creating a window

Using the Windows Management Instrumentation requests

Sending a UDP request

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/491364

Signature

Antivirus / Scanner detection for submitted sample

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7493353a29f1591f88e0013c3aa0fb8810f49be33b111e6c5f1e462b16644c45/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-14 01:42:39 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=osjtkorj6fmr7chaae6dvih3raipjg7dhmir43c7dzdcwftejrcq._file

Verdict:

malicious

Label(s):

agenttesla

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201014-x6129j6gq6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

7493353a29f1591f88e0013c3aa0fb8810f49be33b111e6c5f1e462b16644c45

MD5 hash:

e9f825ea566bba1f1869b39ed4ce7e6a

SHA1 hash:

5e8300e05e7e0073929152305f871a2a18cc98b3

Link:

https://www.unpac.me/results/1be88173-c69d-4228-b991-6800027e6ea9/

SH256 hash:

3d1b4a965909ce9601ab8f05118907ce4d005909e32a93f9cc2b4c6bbf08fa3c

MD5 hash:

5696f7f5a0ac20748c61f33c94168dba

SHA1 hash:

bbc48006c6843f109badab01eeaac070dd984f28

Link:

https://www.unpac.me/results/1be88173-c69d-4228-b991-6800027e6ea9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7493353a29f1591f88e0013c3aa0fb8810f49be33b111e6c5f1e462b16644c45

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.