MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79ff327848f9254764561866a5b26ed55aa24453aea69b1f42dbcad5ac140b00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79ff327848f9254764561866a5b26ed55aa24453aea69b1f42dbcad5ac140b00
SHA3-384 hash: 376becbc7b0fb134602c9c7234ca90ffc7c719cbfb3b31960a9dfba11069a136f36a31b3bd3d04ddf2652228c5efd84e
SHA1 hash: 16a0e21f57cc447b8024999bbd67553c2ffb5e6e
MD5 hash: 636ca0dbbfd6a5c2915781a46d5db5e0
humanhash: carbon-timing-india-double
File name:Operational Instructions BSC BBC.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'169'920 bytes
First seen:2021-09-15 07:09:07 UTC
Last seen:2021-10-04 14:34:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:M/gecNU2zqX6lUB2AkeWoz65UL+PlThD31Z2RESMX3cSIAaR6:lDNgWUB2Ake5zGa+PlThL2RTMX3cn
Threatray 10'253 similar samples on MalwareBazaar
TLSH T1C5459C0073E88A25D6EE3734E4704A5412F7FC5AA53ED78E6945B9AE1EB3B414D203B3
dhash icon 6052b064ec6c6268 (2 x AgentTesla)
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Operational Instructions BSC BBC.pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-09-15 07:24:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d9a8f58a-d183-4c84-a228-1a0ccc2aec66

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/188020/
Detection(s):
SecuriteInfo.com.Malware.AI.1767554360.29023.9314.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
monero obfuscated packed
Link:
https://www.filescan.io/uploads/617515b6a9d585e6d5370ec5/reports/f1b21fdc-f1dc-4d1e-9b25-ad74c7805dc2/overview
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1953b755-a273-4fb7-b246-190e9cfa1528
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/851139
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Sigma detected: Powershell Used To Disable Windows Defender AV Security Monitoring
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 483572 Sample: Operational Instructions BS... Startdate: 15/09/2021 Architecture: WINDOWS Score: 80 25 Found malware configuration 2->25 27 Yara detected AgentTesla 2->27 29 Uses an obfuscated file name to hide its real file extension (double extension) 2->29 31 3 other signatures 2->31 7 Operational Instructions BSC BBC.pdf.exe 4 2->7         started        process3 file4 21 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 7->21 dropped 10 AdvancedRun.exe 1 7->10         started        12 powershell.exe 18 7->12         started        14 AdvancedRun.exe 1 7->14         started        process5 process6 16 AdvancedRun.exe 10->16         started        19 conhost.exe 12->19         started        dnsIp7 23 192.168.2.1 unknown unknown 16->23
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/79ff327848f9254764561866a5b26ed55aa24453aea69b1f42dbcad5ac140b00/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2021-09-15 07:10:14 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ph7te6ci7esuozcwdbtklmto2vnkerctv2tjwh2c3pfnllaubmaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
041fa6acb0d512cd68e538d2e4bd11a9a1345839d3803ec8c096862eafc0cd81
AgentTesla
126f752c7dec6c513804a0737e5d0a03cd8a1082923d68aec35979f3a7db7d60
AgentTesla
337a895245dcdbe522c4320dbe1dfd62e346aecad8246f9b895a5460211865b0
AgentTesla
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
AgentTesla
3ed17d1df70b71852be2335f91bdfe20cd4a319a7d22d407e6e82a8dbe91bc5f
AgentTesla
4065ef6148d82e9b20fb8fb21b7969636fdc0218259f069adffabd3b2882cc81
AgentTesla
517aa4a798cd785cae7bd9722bd79a0f85eadc7a3e9dbfa24440348df4ef7c7c
AgentTesla
7868ece7b29dcba357ff00b1e0394b6e8062eae5512c08a0dea575c2d4f55230
AgentTesla
913accbcc9537c110e0ec272f0aaafa7e8a1fd1a3f525fa7d961ce894a246a60
AgentTesla
e69ebaafa96ca91f70472ad65cfbc6483f65911e715c8eede2707697aca8f077
AgentTesla
+ 10'243 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210915-hzdm1adbbk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
Nirsoft
AgentTesla
Unpacked files
SH256 hash:
1792ec19ba6bfc60a499c1297d819013b7ed222190530fc9fb9bac5a2cc9c0df
MD5 hash:
ac8ce9490b67ae1b14d1350a4d1d1075
SHA1 hash:
97cf48f93488dde1d21454538b3ce223f920ba7c
Link:
https://www.unpac.me/results/dde49fde-eec1-4b86-ad63-6fde2d48aa56/
SH256 hash:
6182fb422df43b5d573edf1285616f1c0bd3e796291cc67c3876fb417d3d3f2e
MD5 hash:
0a8d536e03ab8e3b651f8fa75d24fe1a
SHA1 hash:
93fc602e2e6cff20f067fea189a160a16aca5854
Link:
https://www.unpac.me/results/dde49fde-eec1-4b86-ad63-6fde2d48aa56/
SH256 hash:
79ff327848f9254764561866a5b26ed55aa24453aea69b1f42dbcad5ac140b00
MD5 hash:
636ca0dbbfd6a5c2915781a46d5db5e0
SHA1 hash:
16a0e21f57cc447b8024999bbd67553c2ffb5e6e
Detections:
win_karkoff_auto
Create hunting rule
Link:
https://www.unpac.me/results/dde49fde-eec1-4b86-ad63-6fde2d48aa56/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/79ff327848f9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79ff327848f9254764561866a5b26ed55aa24453aea69b1f42dbcad5ac140b00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_karkoff_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/188020/

Comments