MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720
SHA3-384 hash: da06e33b3e8c05999d93b72b7c2a53aadf9b9546e749eac290c8f54b87e21d82b6da395ace67eff6ae8af396b3454057
SHA1 hash: a943e2d9f5de93ece6fa1e7d9f7c8192c609d6cd
MD5 hash: 9775b8782f6f84f1a8b245f9970f7caf
humanhash: december-avocado-connecticut-hotel
File name:DOC.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:728'064 bytes
First seen:2021-08-03 12:56:20 UTC
Last seen:2021-08-03 13:18:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:rh2LBBBBBBBBBBBXBBBBBBBBBBBO+mXnBrefjnCTB9t3i43w9UZIN4WVKv+OuS7d:N+IBEKH69gjzc7Sd25KNtMMALEhfAju
Threatray 121 similar samples on MalwareBazaar
TLSH T19DF401BAEF998F2BC17C08F9A252160D02F6859AA141E7793CDF15FC14C23D167A12DB
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOC.exe
Verdict:
Suspicious activity
Analysis date:
2021-08-03 13:00:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a456c324-5b28-4f4b-aa96-2ce3e2b73b8c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176050/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20210803-0610.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5a22348-c547-49d9-9313-649b39734b6a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826158
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Process Start Without DLL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458595 Sample: DOC.exe Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 20 Found malware configuration 2->20 22 Antivirus / Scanner detection for submitted sample 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 6 other signatures 2->26 6 DOC.exe 3 2->6         started        process3 file4 18 C:\Users\user\AppData\Local\...\DOC.exe.log, ASCII 6->18 dropped 28 Detected unpacking (overwrites its own PE header) 6->28 10 RegSvcs.exe 6->10         started        12 RegSvcs.exe 6->12         started        14 RegSvcs.exe 6->14         started        16 2 other processes 6->16 signatures5 process6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 04:25:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oth3v7hs7wlfik25iiq7t7edtrj4qs7jxxgvgntd2s2rfirk44qa._file
Verdict:
unknown
Similar samples:
222a4967f9a54868a341540a2594382c7023cc1bc298da15041616954eef4a71
AgentTesla
60869d9c3d3b8f30089a849750b4e721fbc3501136727442382f327c07c60f5f
AgentTesla
90d1b1d870c2b99c0d9773afc353bf3e96cc5806169f911753362f2fb41d1934
AgentTesla
9a046a2f73df3a0bd2880b04fa658d3cf278edd40c6fca7f9dbde5342510d085
AgentTesla
b58a776cf07315618ecd00ac91fec52b5835e3af3cb743642df97ce0c95e69b4
AgentTesla
da2c90083bd3bf27f6bb3bd87a23fb71dabbb12305e5a190afc6e3cc3344c32b
AgentTesla
ef493fe2688db7c97fd7e0af12bae0b42aeee9c1c7ccf241865e1cfa5cb50cac
AgentTesla
+ 111 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210803-zxxhbra52n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
aaac49d144f62d66205fe7e7fb4b3fbcb63dbd4419e06d3d780a337bf4381b45
MD5 hash:
37571c54330695d5de51ae2196f0ee4f
SHA1 hash:
fb01bccdf249578178da2edbe77054a2bbf16984
Link:
https://www.unpac.me/results/1ca4baf6-3fb2-4605-93ed-295fb71927f3/
SH256 hash:
597d239fead703cdb7fa7f5addad35817a7d40181f6289a8062e281886013b84
MD5 hash:
c46623d7534f6e17c6da1b345881a74c
SHA1 hash:
2381b96e75eacccd16e862f29c3fdaa902daf458
Link:
https://www.unpac.me/results/1ca4baf6-3fb2-4605-93ed-295fb71927f3/
SH256 hash:
cfef97ff706312dff4edd998aeee22f1283221631ebb0cc954bebbb701c1465c
MD5 hash:
a0f625a3d3348903f3c902f588c0e4f5
SHA1 hash:
20d1f0b74abe6f500e8c21119f55281926210ac0
Link:
https://www.unpac.me/results/1ca4baf6-3fb2-4605-93ed-295fb71927f3/
SH256 hash:
74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720
MD5 hash:
9775b8782f6f84f1a8b245f9970f7caf
SHA1 hash:
a943e2d9f5de93ece6fa1e7d9f7c8192c609d6cd
Link:
https://www.unpac.me/results/1ca4baf6-3fb2-4605-93ed-295fb71927f3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/74cfbafcf2fd96542b5d4221f9fc839c53c84be9bdcd533663d4b512a22ae720

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/176050/

Comments