MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Bancteian


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21
SHA3-384 hash: eccc6f1a26aa0014fe7d55a45452f6d7b87eebc9e36a24c4286519cd09728aeb20fe6b30be3f582722c1538073e10ead
SHA1 hash: 01d7555f0ce185f4f37a81908cdf381bdbb78f89
MD5 hash: f3e078212b206e6126ce41c89a29ff10
humanhash: helium-grey-summer-wisconsin
File name:SOA of AUGUST 2020.exe
Download: download sample
Signature Bancteian
Create hunting rule
File size:4'770'355 bytes
First seen:2020-11-06 07:25:14 UTC
Last seen:2020-11-09 06:24:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d349bb1fedb23758a6e397e5d691576 (8 x Bancteian, 7 x AZORult, 1 x AgentTesla)
ssdeep 49152:+UJ6ZNXox4SgJhBsfHJq/nCFT4Mv0Pt97HwgATaSV5CjrwZFfv2A8:+tR4xGnCtvw8NTaSV5CjrSBvB8
TLSH 3B268E57B284A93FC06B073B882766509A7FBF2166269C0F17F078CC4E7D5817E2964B
Reporter cocaman
Tags:Bancteian exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Bancteian-0-6418983-0
Create hunting rule

Win.Malware.Delf-6821969-0
Create hunting rule

Win.Malware.Delf-6821971-0
Create hunting rule

Win.Trojan.Delf-33906
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the Windows directory
Changing a file
Moving a file to the Windows directory
Moving a recently created file
Creating a file in the %AppData% directory
Moving a file to the %AppData% directory
Setting a keyboard event handler
Blocking the User Account Control
Unauthorized injection to a recently created process
Enabling autorun
Enabling a "Do not show hidden files" option
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/522208
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an undocumented autostart registry key
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 310209 Sample: SOA of AUGUST 2020.exe Startdate: 06/11/2020 Architecture: WINDOWS Score: 100 63 mail.akdogulojistik.com 2->63 65 akdogulojistik.com 2->65 79 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->79 81 Found malware configuration 2->81 83 Antivirus detection for dropped file 2->83 85 13 other signatures 2->85 9 SOA of AUGUST 2020.exe 3 2->9         started        12 CsGlckR.exe 2->12         started        signatures3 process4 file5 41 C:\Users\user\...\SOA of AUGUST 2020.exe, PE32 9->41 dropped 43 C:\Users\user\AppData\Local\...\icsys.ico.exe, PE32 9->43 dropped 14 icsys.ico.exe 13 9->14         started        18 SOA of AUGUST 2020.exe 6 9->18         started        20 conhost.exe 12->20         started        process6 file7 49 C:\Windows\wininit.exe, PE32 14->49 dropped 51 C:\Windows\RCX4C84.tmp, PE32 14->51 dropped 53 C:\Users\user\AppData\Roaming\spoolsv.exe, PE32 14->53 dropped 61 4 other malicious files 14->61 dropped 105 Antivirus detection for dropped file 14->105 107 Machine Learning detection for dropped file 14->107 109 Drops executables to the windows directory (C:\Windows) and starts them 14->109 111 Drops PE files with benign system names 14->111 22 wininit.exe 12 14->22         started        26 svchost.exe 14->26         started        55 C:\Users\user\AppData\...\zfmZXiYzGxrTR.exe, PE32 18->55 dropped 57 C:\Users\user\AppData\Local\...\tmp6C21.tmp, XML 18->57 dropped 59 C:\Users\user\...\SOA of AUGUST 2020.exe .log, ASCII 18->59 dropped 113 Writes to foreign memory regions 18->113 115 Injects a PE file into a foreign processes 18->115 28 RegSvcs.exe 17 4 18->28         started        31 RegSvcs.exe 18->31         started        33 schtasks.exe 1 18->33         started        signatures8 process9 dnsIp10 67 edge-block-www-env.dropbox-dns.com 162.125.66.15, 443, 49747, 49748 DROPBOXUS United States 22->67 69 192.168.2.1 unknown unknown 22->69 71 dl.dropboxusercontent.com 22->71 87 Antivirus detection for dropped file 22->87 89 Creates an undocumented autostart registry key 22->89 91 Machine Learning detection for dropped file 22->91 93 Installs a global keyboard hook 22->93 95 Tries to harvest and steal browser information (history, passwords, etc) 26->95 73 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.182.194, 443, 49882 AMAZON-AESUS United States 28->73 75 nagano-19599.herokussl.com 28->75 77 api.ipify.org 28->77 45 C:\Users\user\AppData\Roaming\...\CsGlckR.exe, PE32 28->45 dropped 47 C:\Windows\System32\drivers\etc\hosts, ASCII 28->47 dropped 97 Modifies the hosts file 28->97 99 Hides that the sample has been downloaded from the Internet (zone.identifier) 28->99 101 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 31->101 103 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 31->103 35 conhost.exe 31->35         started        37 conhost.exe 33->37         started        39 conhost.exe 33->39         started        file11 signatures12 process13
Detection:
azorult
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21/
Threat name:
Win32.Trojan.Bancteian
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 07:27:05 UTC
File Type:
PE (Exe)
Extracted files:
65
AV detection:
29 of 29 (100.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ptybneqpml2m3gcpt7ojzglwwb4irserwuviy3evyr6mgyul3yqq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware trojan
Link:
https://tria.ge/reports/201106-lwpsw5hhl2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Drops file in Windows directory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Drops file in Drivers directory
Executes dropped EXE
Modifies WinLogon for persistence
Modifies visiblity of hidden/system files in Explorer
UAC bypass
Unpacked files
SH256 hash:
7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21
MD5 hash:
f3e078212b206e6126ce41c89a29ff10
SHA1 hash:
01d7555f0ce185f4f37a81908cdf381bdbb78f89
Link:
https://www.unpac.me/results/994382c6-94f0-44e9-91b4-9f2063cd1562/
SH256 hash:
1a308b762a7a44deb6f21b0fbc10d7b12c660c35fd8cfa37f394dd00ad210de9
MD5 hash:
aff72eb7c0af4918acc449c64683dcee
SHA1 hash:
fa7640f8420148188a005f607e35134b596fd744
Link:
https://www.unpac.me/results/994382c6-94f0-44e9-91b4-9f2063cd1562/
SH256 hash:
870be38d162065958c7cc649b0a1b16bc0874e0646225fd1b72679dc26783e88
MD5 hash:
e431950694d9ff88cc7f33d5d3f9611b
SHA1 hash:
bf89750f6d8e2db3db5c84efcc65708ab1592245
Link:
https://www.unpac.me/results/994382c6-94f0-44e9-91b4-9f2063cd1562/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/994382c6-94f0-44e9-91b4-9f2063cd1562/
SH256 hash:
4c2e2ecc93f4fd8c74f7c294eb4c6b5d2ef3aba9b1eebcd9797dd2d9ab71c367
MD5 hash:
35635114fea5761438c14e677ac66c40
SHA1 hash:
76a3b0a64c6160eee5ecaa8c9d458f698cbf7a0d
Link:
https://www.unpac.me/results/994382c6-94f0-44e9-91b4-9f2063cd1562/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Bancteian

rar cb29038762ba30a0daef186e9bd77495d49c4316ea43cbf81b7903234d0f1098

Bancteian

Executable exe 7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 cb29038762ba30a0daef186e9bd77495d49c4316ea43cbf81b7903234d0f1098

Comments