MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84858fb9b1e2533886a654de52671d91b9d9d7f77ecc7a883d6f03821376b3c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84858fb9b1e2533886a654de52671d91b9d9d7f77ecc7a883d6f03821376b3c3
SHA3-384 hash: 81777c66128a56df00e01d65b589e4e35c921ac7ed82240f067b09416edf58e17089e826017878dbca30c192c88289ec
SHA1 hash: d109afcd25263a2eb40ea2576903058366a2136a
MD5 hash: d0074fb87165455483cacfb6a359ecb6
humanhash: avocado-beer-ack-single
File name:DOC_457800_366776_3673636_76638-737979.DOC.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:82'080 bytes
First seen:2021-03-09 06:32:03 UTC
Last seen:2021-03-09 08:38:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:Fp5xVyhqBZTrZpLWJ5m/Eo/1SpoXo7cooEu11A/67mE11A1q5qXS5ALWS51j1A/z:FHxVyhOXpLWJ5m/Eo/1SpoXo7cooEu1b
Threatray 3'156 similar samples on MalwareBazaar
TLSH 598394182F909927E28F4873485EB7C04D3D72BEB04797AD6BEFA1A55FE51041C4EE28
Reporter cocaman
Tags:AgentTesla exe signed

Code Signing Certificate

Organisation:JtjOArpDmkPM
Issuer:JtjOArpDmkPM
Algorithm:sha256WithRSAEncryption
Valid from:2021-03-08T23:50:33Z
Valid to:2022-03-08T23:50:33Z
Serial number: ca7ae819b75b625c136a11459f322ddd
Thumbprint Algorithm:SHA256
Thumbprint: 6a4c9c25707a678726a05e72cb221de2ab3b24b71403035ad724267cc99c13e3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOC_457800_366776_3673636_76638-737979.DOC.EXE
Verdict:
Malicious activity
Analysis date:
2021-03-09 06:33:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/670b09ac-76d1-4389-a45d-6f7a690dabca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123094/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.16646.32532.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending an HTTP GET request
Creating a file
Moving a recently created file
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Launching a service
Sending a UDP request
Deleting a recently created file
Launching a process
Creating a file in the Windows subdirectories
Setting a single autorun event
Blocking the User Account Control
Adding exclusions to Windows Defender
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/632326
Signature
Adds a directory exclusion to Windows Defender
Binary contains a suspicious time stamp
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Initial sample is a PE file and has a suspicious name
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 365132 Sample: DOC_457800_366776_3673636_7... Startdate: 09/03/2021 Architecture: WINDOWS Score: 84 86 Uses an obfuscated file name to hide its real file extension (double extension) 2->86 88 Initial sample is a PE file and has a suspicious name 2->88 90 Binary contains a suspicious time stamp 2->90 92 3 other signatures 2->92 8 DOC_457800_366776_3673636_76638-737979.DOC.EXE 23 17 2->8         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        17 3 other processes 2->17 process3 dnsIp4 76 liverpoolofcfanclub.com 172.67.174.240, 49697, 80 CLOUDFLARENETUS United States 8->76 64 C:\Windows\Microsoft.NET\...\svchost.exe, PE32 8->64 dropped 66 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->66 dropped 68 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 8->68 dropped 70 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 8->70 dropped 94 Creates an autostart registry key pointing to binary in C:\Windows 8->94 96 Adds a directory exclusion to Windows Defender 8->96 98 Drops PE files with benign system names 8->98 19 powershell.exe 25 8->19         started        21 powershell.exe 24 8->21         started        23 AdvancedRun.exe 1 8->23         started        32 2 other processes 8->32 100 Drops executables to the windows directory (C:\Windows) and starts them 13->100 25 svchost.exe 13->25         started        30 svchost.exe 15->30         started        78 192.168.2.1 unknown unknown 17->78 file5 signatures6 process7 dnsIp8 34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        38 AdvancedRun.exe 23->38         started        80 liverpoolofcfanclub.com 25->80 72 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 25->72 dropped 102 System process connects to network (likely due to code injection or exploit) 25->102 104 Adds a directory exclusion to Windows Defender 25->104 40 AdvancedRun.exe 25->40         started        46 2 other processes 25->46 82 104.21.31.39, 49702, 49705, 80 CLOUDFLARENETUS United States 30->82 84 liverpoolofcfanclub.com 30->84 74 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 30->74 dropped 42 AdvancedRun.exe 30->42         started        44 powershell.exe 30->44         started        48 2 other processes 30->48 50 2 other processes 32->50 file9 signatures10 process11 process12 52 AdvancedRun.exe 40->52         started        54 AdvancedRun.exe 42->54         started        56 conhost.exe 44->56         started        58 conhost.exe 46->58         started        60 conhost.exe 48->60         started        62 conhost.exe 48->62         started       
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-09 06:32:11 UTC
File Type:
PE (.Net Exe)
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qscy7onr4jjtrbvgktpfezy5sg45tv7xp3ghvcb5n4byee3wwpbq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
181929c58e5ce4833a2847c9ff077dd87e8c0128793217d7e690311087ecc80a
AgentTesla
38436d4f78977a760f11f9590f6a9e58be5d1b2a0f1dd7c7841fc525812b5a0e
AgentTesla
459a96d9c261c779036f999c0bb2bc01a2e9126a48cdffb01748a639e63da1a5
AgentTesla
569d9358801eb518b152cb73009131508a3f14b136b0eb80025ccf438865a440
AgentTesla
98245891a284abcccb56bb8ccd774fbcde277259432b07294d7e3e7b864c30c1
AgentTesla
a09cc41fc5c688ee8d659a26c7a50d422513b8fc6a1636ae091a1572855a5041
AgentTesla
b2b6eff8a6c60704b212b98e6eb03be8bd26e1dc3bd8b6f28774bd6a52badb6d
AgentTesla
d830adad4946e743cdc39b91ce67e2c3c0ff9aedda4cf205d1756ac45bb7b2e8
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
f892fa6757d9aab17b11c24debe91cc7ecd4591bc656f9e653dacf883a1b764f
AgentTesla
+ 3'146 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210309-48x7c6texj/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
84858fb9b1e2533886a654de52671d91b9d9d7f77ecc7a883d6f03821376b3c3
MD5 hash:
d0074fb87165455483cacfb6a359ecb6
SHA1 hash:
d109afcd25263a2eb40ea2576903058366a2136a
Link:
https://www.unpac.me/results/502b486f-4ee7-49a7-87d1-5840398e2347/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/84858fb9b1e2533886a654de52671d91b9d9d7f77ecc7a883d6f03821376b3c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 0d8a83846d4bd3ac3d473c27061cb4afd3814d53355c6b1a028bc9a742b0fac0

AgentTesla

Executable exe 84858fb9b1e2533886a654de52671d91b9d9d7f77ecc7a883d6f03821376b3c3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 0d8a83846d4bd3ac3d473c27061cb4afd3814d53355c6b1a028bc9a742b0fac0
Cape
Cape
https://www.capesandbox.com/analysis/123094/

Comments