MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d
SHA3-384 hash: 3b350975f120d2cb3e6208ef9ddeba37eb706b9a979bb6052c868c1fdf2c731aaeb9ddb13fd1294a59bbe83b5332c147
SHA1 hash: 634d2df6aeabb04ca0fb511a757426be9181b979
MD5 hash: 6295ce59e53dca7e52d19a54f4001a19
humanhash: minnesota-floor-artist-hawaii
File name:IRq0c4lGEaW9MTr.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:683'008 bytes
First seen:2021-11-22 07:37:35 UTC
Last seen:2021-11-22 12:22:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:76sjtD00GYPjGJpInD08qAcuOHsE6UpTd5eBjV8fVUnt:msjC0Guj6p8PH5OHrtdatt
Threatray 12'873 similar samples on MalwareBazaar
TLSH T15AE49DA02150C145ED59CB3CD83D9A443A363DF6293CD6CD5CABFA8F3A3360716E6992
File icon (PE):PE icon
dhash icon 1f185b7767535b47 (14 x AgentTesla, 5 x Formbook, 1 x RedLineStealer)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IRq0c4lGEaW9MTr.exe
Verdict:
Malicious activity
Analysis date:
2021-11-22 07:43:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/70110c34-526b-421d-9dd5-cbe9dde63920

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.2712.8605.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619b48de94a88037d2fddeb0/reports/8a442b60-a2a4-41f2-b417-6a1e978cf374/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ca47238a-802b-469a-ba0f-1649e452ee36
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/893616
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 526090 Sample: IRq0c4lGEaW9MTr.exe Startdate: 22/11/2021 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->36 38 Yara detected AgentTesla 2->38 40 5 other signatures 2->40 7 IRq0c4lGEaW9MTr.exe 7 2->7         started        process3 dnsIp4 28 192.168.2.1 unknown unknown 7->28 24 C:\Users\user\AppData\Roaming\lunXsPd.exe, PE32 7->24 dropped 26 C:\Users\user\AppData\Local\...\tmp92CA.tmp, XML 7->26 dropped 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->42 44 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->44 46 Uses schtasks.exe or at.exe to add and modify task schedules 7->46 48 Adds a directory exclusion to Windows Defender 7->48 12 IRq0c4lGEaW9MTr.exe 2 7->12         started        16 powershell.exe 24 7->16         started        18 schtasks.exe 1 7->18         started        file5 signatures6 process7 dnsIp8 30 medicare-equipment.com 192.185.84.191, 49810, 587 UNIFIEDLAYER-AS-1US United States 12->30 32 mail.medicare-equipment.com 12->32 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->50 52 Tries to steal Mail credentials (via file / registry access) 12->52 54 Tries to harvest and steal ftp login credentials 12->54 56 Tries to harvest and steal browser information (history, passwords, etc) 12->56 20 conhost.exe 16->20         started        22 conhost.exe 18->22         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 07:38:05 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhlkar2iabpckmtrlhafh5ivealskyk3xlec4xxcbd7hpghsd5gq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
282d6681e5e1304bd29f09402203553e6d0ec03a4c9a55496bf6f6f7a8efae01
AgentTesla
50e9dfae83442184dd88345e7d70c15a5dca42bd827855e49ec03c4e0e072c2f
AgentTesla
5ccf09f147388edaa189fdfa1549da2240b908203d6830ee2ce4f0289838b26a
AgentTesla
9688d2c06e035135c93acce300cd62d4dff1e7dca350dd7f95455a2f9baafce2
AgentTesla
bd17aef5a6e188bd70166012321f6e131a403a6b663df81be05d9f104a4718a7
AgentTesla
df2bc7250fba8f6d5e61c183cb8d680b66713d9ba8b6228cdf93222fdf73f302
AgentTesla
f9330611bf9a77b6ad70f94f498bc80acd491ad7827cb2deb9bdaf450a577579
AgentTesla
+ 12'863 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211122-jgd2gsfadq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c51f275bdf6fe97f9f59047c436954dd7d284e4cda49c5cb440ce9cbe5b7402f
MD5 hash:
092a720ea11bac6f32c04123c9a5f1c8
SHA1 hash:
fa7459b35d1a85b0f9ec30a88f014549dad44a5c
Link:
https://www.unpac.me/results/c7768109-d441-4faf-9dec-2d3e3dcb19fc/
SH256 hash:
128a10466bc229679a77c11e49f6715a448b6be62867097b343138e52348e811
MD5 hash:
9a9e7733f8711feabc41be8b8d2eda3f
SHA1 hash:
0e6ad270dc1a88f41488db14f3ada7a4e94291f8
Link:
https://www.unpac.me/results/c7768109-d441-4faf-9dec-2d3e3dcb19fc/
SH256 hash:
f30ca642597c059f9dbcc6cfea27687245fbcaf5456be0b7a4528d946f3a0a05
MD5 hash:
0f6349011cf5446131faf0cadbace87b
SHA1 hash:
0cd48b5cb5a0ca095043c333c9002ba5273e92e8
Link:
https://www.unpac.me/results/c7768109-d441-4faf-9dec-2d3e3dcb19fc/
SH256 hash:
89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d
MD5 hash:
6295ce59e53dca7e52d19a54f4001a19
SHA1 hash:
634d2df6aeabb04ca0fb511a757426be9181b979
Link:
https://www.unpac.me/results/c7768109-d441-4faf-9dec-2d3e3dcb19fc/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/89d6a0474800/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 89d6a04748005e25327159c053f515201725615bbac82e5ee208fe7798f21f4d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/208025/

Comments