MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28
SHA3-384 hash: 0cf44f8e81a255eaeb36d055176163226de3e24970925f0f42c4f51eb5f74f11726e165eb772ea8d2caf757139c2676a
SHA1 hash: db390685c996fd7eac328a1ee0f327534c3f2082
MD5 hash: 289534e645c825158eeb6a9caad0f9b6
humanhash: fanta-louisiana-oscar-snake
File name:DOWNLOAD_457800_366776_3673636_76638-737979.DOC.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:19'264 bytes
First seen:2021-03-11 06:28:10 UTC
Last seen:2021-03-11 08:47:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 384:QBOu6akQit9Ah46EUT2sxi5XrNX3GeD8NR7mUhRP:vJFr9CpT2VhnDehRP
Threatray 3'264 similar samples on MalwareBazaar
TLSH 7C822915EAEA8615E43FEF362CE085F41DFA7743B954CA7E044441499A237C0EE32E76
Reporter cocaman
Tags:AgentTesla DHL exe signed

Code Signing Certificate

Organisation:GmQkwKAYVvxNwNkgwcIZREZQpFkCkvRue
Issuer:GmQkwKAYVvxNwNkgwcIZREZQpFkCkvRue
Algorithm:sha256WithRSAEncryption
Valid from:2021-03-11T00:43:33Z
Valid to:2022-03-11T00:43:33Z
Serial number: 3fdb6ccc25d9de335f49014fa3012ce2
Thumbprint Algorithm:SHA256
Thumbprint: 5cf2a1d9285b750b670fe71abca37b88bdadd667912e9b3baa216d9da95ba889
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOWNLOAD_457800_366776_3673636_76638-737979.DOC.EXE
Verdict:
Malicious activity
Analysis date:
2021-03-11 06:30:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/416e3f45-f0ff-4fbb-bd98-5d9fc9193237

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123693/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.10503.18969.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending an HTTP GET request
Creating a file
Moving a recently created file
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Sending a UDP request
Launching a service
Deleting a recently created file
Launching a process
Creating a file in the Windows subdirectories
Setting a single autorun event
Blocking the User Account Control
Adding exclusions to Windows Defender
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/636443
Signature
Adds a directory exclusion to Windows Defender
Binary contains a suspicious time stamp
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files with benign system names
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 367196 Sample: DOWNLOAD_457800_366776_3673... Startdate: 11/03/2021 Architecture: WINDOWS Score: 92 76 Multi AV Scanner detection for submitted file 2->76 78 Uses an obfuscated file name to hide its real file extension (double extension) 2->78 80 Binary contains a suspicious time stamp 2->80 82 3 other signatures 2->82 8 DOWNLOAD_457800_366776_3673636_76638-737979.DOC.EXE 23 17 2->8         started        13 explorer.exe 2->13         started        15 explorer.exe 2->15         started        17 13 other processes 2->17 process3 dnsIp4 72 liverpoolofcfanclub.com 172.67.174.240, 49710, 49731, 49732 CLOUDFLARENETUS United States 8->72 52 C:\Windows\Resources\Themes\...\svchost.exe, PE32 8->52 dropped 54 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 8->54 dropped 56 DOWNLOAD_457800_36...-737979.DOC.EXE.log, ASCII 8->56 dropped 58 2 other files (none is malicious) 8->58 dropped 84 Creates an autostart registry key pointing to binary in C:\Windows 8->84 86 Adds a directory exclusion to Windows Defender 8->86 88 Drops PE files with benign system names 8->88 19 AdvancedRun.exe 1 8->19         started        22 powershell.exe 23 8->22         started        24 powershell.exe 26 8->24         started        34 2 other processes 8->34 90 Drops executables to the windows directory (C:\Windows) and starts them 13->90 26 svchost.exe 13->26         started        30 svchost.exe 15->30         started        74 127.0.0.1 unknown unknown 17->74 92 Changes security center settings (notifications, updates, antivirus, firewall) 17->92 32 MpCmdRun.exe 17->32         started        file5 signatures6 process7 dnsIp8 64 192.168.2.1 unknown unknown 19->64 36 AdvancedRun.exe 19->36         started        38 conhost.exe 22->38         started        40 conhost.exe 24->40         started        66 liverpoolofcfanclub.com 26->66 60 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 26->60 dropped 94 System process connects to network (likely due to code injection or exploit) 26->94 42 AdvancedRun.exe 26->42         started        68 104.21.31.39, 49725, 80 CLOUDFLARENETUS United States 30->68 70 liverpoolofcfanclub.com 30->70 62 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 30->62 dropped 44 conhost.exe 32->44         started        46 conhost.exe 34->46         started        48 AdvancedRun.exe 34->48         started        file9 signatures10 process11 process12 50 AdvancedRun.exe 36->50         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-11 06:29:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qugyiwnbmbiyohsmmvvx6g22d57lilawljzil5kwbwa2abucduua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07c81cceba2e04d6daebd227f37525bd931d19491dc6dc903e99b0176f1a9252
AgentTesla
3fe64ef36bf563c4b88c055af8b943a326084b40388143459c71ab199242f7ec
AgentTesla
459a96d9c261c779036f999c0bb2bc01a2e9126a48cdffb01748a639e63da1a5
AgentTesla
747ee0971e16540fa80072cdcc9e28a2f3fca2303303920c802219ea64c5bef2
AgentTesla
8ab6e7ca68c0c1ab0e39ede908135343fbfbfdeb3b6981f4630e6c74e73d7ca3
AgentTesla
98245891a284abcccb56bb8ccd774fbcde277259432b07294d7e3e7b864c30c1
AgentTesla
b2b6eff8a6c60704b212b98e6eb03be8bd26e1dc3bd8b6f28774bd6a52badb6d
AgentTesla
d830adad4946e743cdc39b91ce67e2c3c0ff9aedda4cf205d1756ac45bb7b2e8
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
f892fa6757d9aab17b11c24debe91cc7ecd4591bc656f9e653dacf883a1b764f
AgentTesla
+ 3'254 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence trojan
Link:
https://tria.ge/reports/210311-pjt9jwdyks/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Windows security modification
Executes dropped EXE
Nirsoft
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28
MD5 hash:
289534e645c825158eeb6a9caad0f9b6
SHA1 hash:
db390685c996fd7eac328a1ee0f327534c3f2082
Link:
https://www.unpac.me/results/b4028b9c-cce8-46dc-a99a-c3bb0e3cf805/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f

AgentTesla

Executable exe 850d8459a16051871e4c656b7f1b5a1f7eb42c165a7285f5560d81a006821d28

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 ec7df49f3f2723542a0fddd152b36ec72f8bba3f75d86136ec7625575134371f
Cape
Cape
https://www.capesandbox.com/analysis/123693/

Comments