MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc
SHA3-384 hash: 01c9f2017ca336fa6c8d23916de5d58dcf562c52ff3199c1a95a941ef8dfdb85ab5383dd1726dff85daabc9282edafcf
SHA1 hash: 023e086649daeb8d3d68b65aaade9581ac5d2c90
MD5 hash: 2b42c19ebca7dcd6d00adafa088752ed
humanhash: six-fifteen-music-lake
File name:2b42c19ebca7dcd6d00adafa088752ed
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'327'616 bytes
First seen:2023-03-02 13:28:30 UTC
Last seen:2023-03-02 15:28:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:cSSDYevHIXiJj+750g7wYbSsAR9Y0AaD8GvxGo:cKeOik2Mm1Aagdo
Threatray 1'085 similar samples on MalwareBazaar
TLSH T10D55B72809FC0AF2C5B1F1FD9FE4E753BD808CE6A6049D9982834B89555395720AFD3E
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SWIFT DETAILS 204.xls
Verdict:
Malicious activity
Analysis date:
2023-03-02 12:34:08 UTC
Tags:
opendir exploit cve-2017-11882 loader
Link:
https://app.any.run/tasks/98a4349a-2215-458c-9231-87ac52dffb80

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371221/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.29354.28970.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6400a4a0bbedb8176ff232f9/reports/a7c02f6b-e9f0-4a53-84e7-c34c0b26e336/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9ba37bc0-dfe1-4462-b5a3-eef6d5b439d7
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1185758
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 818623 Sample: G3uqVBc5qs.exe Startdate: 02/03/2023 Architecture: WINDOWS Score: 100 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected AgentTesla 2->49 51 Machine Learning detection for sample 2->51 6 G3uqVBc5qs.exe 3 2->6         started        10 gcWPrHZ.exe 3 2->10         started        12 gcWPrHZ.exe 2 2->12         started        process3 file4 27 C:\Users\user\AppData\...behaviorgraph3uqVBc5qs.exe.log, ASCII 6->27 dropped 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->55 57 Injects a PE file into a foreign processes 6->57 14 G3uqVBc5qs.exe 2 5 6->14         started        19 G3uqVBc5qs.exe 6->19         started        21 G3uqVBc5qs.exe 6->21         started        59 Multi AV Scanner detection for dropped file 10->59 61 Machine Learning detection for dropped file 10->61 23 gcWPrHZ.exe 2 10->23         started        25 gcWPrHZ.exe 2 12->25         started        signatures5 process6 dnsIp7 33 us2.smtp.mailhostbox.com 208.91.199.224, 49697, 587 PUBLIC-DOMAIN-REGISTRYUS United States 14->33 29 C:\Users\user\AppData\Roaming\...\gcWPrHZ.exe, PE32 14->29 dropped 31 C:\Users\user\...\gcWPrHZ.exe:Zone.Identifier, ASCII 14->31 dropped 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->39 41 Tries to steal Mail credentials (via file / registry access) 14->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->43 35 208.91.199.223, 49701, 49704, 587 PUBLIC-DOMAIN-REGISTRYUS United States 23->35 37 192.168.2.1 unknown unknown 23->37 45 Tries to harvest and steal browser information (history, passwords, etc) 25->45 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-03-02 13:29:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rb6i4kck2vduf2zwcsj67bqumq2sdxs5f3swll6slbrvw4w3ulga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06a6922bd3e72833299792b1a21525cbd54cd1bf0637692c80d074f6dc47080d
AgentTesla
77954aceb0ce403be86b14588e57bba75c06e9a0b65d4ddc01b1ca6e55770102
AgentTesla
96c1f2e81dd6ac90324fe3eebbbd592670b5769adf64c8a73fb345d1749d4b02
AgentTesla
9a8c1fe1c53db8a44a8971664845fc5a63f34199504f3156101d8005059247a9
AgentTesla
a46f5213113d894ca3e9dc9ec6d66ab9e46253d05d08a035a0e2e817744047a2
AgentTesla
b97359d81ff705942e503b8a9636d0260a6de0d6c7d00fe6a104e6413eebf5b6
AgentTesla
d975348bc9e2938f9bbb8f8c96f20cbc74c0241ef9e0847a853233fd962f73fa
AgentTesla
+ 1'075 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230302-qq8qsacg2w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
7b734684fb0f90b16d77ef776ac6a5b3e941953126b32ec0870982bcc2aa09b7
MD5 hash:
fccb465f30304ae4d5a0df4a20b5e590
SHA1 hash:
c28847b45b0c30ba73efd0fbcbce2f4dfbf95087
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
SH256 hash:
1ca385bd3f4ca0493e3efcd83451292b0add472eac326f2a16b1344c01ce9a55
MD5 hash:
941cefb61cfb63d2ba8b6331fc335213
SHA1 hash:
bf1fdb6224a5361d9231e6acd83454dae6a152b3
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
SH256 hash:
7f2a5e5f0dcbf387f3d6b29bfa5aabde0302f5291f668f95ae14d9b63a298f00
MD5 hash:
ba4d5b480f747ecc77c4a7af2bcc3c94
SHA1 hash:
95d312c8bcbb4df4c753d75a9518cf4ab4940c10
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
SH256 hash:
01c8b0435d8947e264468988bc6fd0a4ee36da1016885825ec59183651392a8b
MD5 hash:
151bed0d135a957da4f734d176acff84
SHA1 hash:
6e8d849a9a8a7739bb84b48f256b64be1561fdff
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
SH256 hash:
8f0c7e3047346b8d6477ff6d4639fd6157602c7ebc840f3432b99263f1cb415c
MD5 hash:
e5b073b30db1b058298f5df032164e4d
SHA1 hash:
15d3ada4e7ac01b766615b9b66785e7e2ae9b0ca
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
SH256 hash:
887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc
MD5 hash:
2b42c19ebca7dcd6d00adafa088752ed
SHA1 hash:
023e086649daeb8d3d68b65aaade9581ac5d2c90
Link:
https://www.unpac.me/results/561acb90-0e9e-407b-94f5-d5fc3593d7b7/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/887c8e284ad5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 887c8e284ad54742eb361493ef8614643521de5d2ee565afd258635b72dba2cc

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2555072/
Cape
Cape
https://www.capesandbox.com/analysis/371221/

Comments


Avatar
zbet commented on 2023-03-02 13:28:42 UTC

url : hxxp://192.3.101.160/204/vbc.exe