MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725
SHA3-384 hash: e31592edc9e028b2d78aebff3fb257379740571c614117397fa0423e2fe1cc0f1184792543076c8812c491cb95361c61
SHA1 hash: 0b8b879df448e5f4cfba7300a4c3e0bf5ec8b2c8
MD5 hash: 1167c4b794deb28577fd99935b732a34
humanhash: washington-leopard-crazy-don
File name:Sample_Item.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:279'287 bytes
First seen:2021-03-05 06:40:01 UTC
Last seen:2021-03-10 18:49:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:l8LxBj0ypaS4TaQ12clqs32yGkwTnc4FnIhidNyQG87Rmj2wIMe:0Ra7+mNqsrGkwTJIhANG87RIde
Threatray 3'034 similar samples on MalwareBazaar
TLSH 0354121AA2E15975C4D79F764C39AABAFB7367140071F2078398EEFB1C20AC7861A641
Reporter fabjer
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Sample_Item.exe
Verdict:
Malicious activity
Analysis date:
2021-03-05 06:42:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/84dbf59d-0947-48b3-bc3c-a8669bcfd3e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122404/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Creating a window
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/629450
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 363697 Sample: Sample_Item.exe Startdate: 05/03/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 4 other signatures 2->51 8 vbc.exe 11 2->8         started        12 Sample_Item.exe 1 13 2->12         started        process3 file4 29 C:\Users\user\AppData\...\c15kbfz6xhqm.dll, PE32 8->29 dropped 53 Multi AV Scanner detection for dropped file 8->53 55 Detected unpacking (changes PE section rights) 8->55 57 Detected unpacking (overwrites its own PE header) 8->57 59 Machine Learning detection for dropped file 8->59 14 vbc.exe 12 8->14         started        31 C:\Users\user\AppData\Roaming\name\vbc.exe, PE32 12->31 dropped 33 C:\Users\user\AppData\...\c15kbfz6xhqm.dll, PE32 12->33 dropped 61 Maps a DLL or memory area into another process 12->61 16 Sample_Item.exe 2 12 12->16         started        signatures5 process6 process7 18 iexplore.exe 14->18         started        20 iexplore.exe 1 58 16->20         started        process8 22 iexplore.exe 32 20->22         started        25 iexplore.exe 66 20->25         started        27 iexplore.exe 31 20->27         started        dnsIp9 35 140.82.121.4, 443, 49757, 49758 GITHUBUS United States 22->35 37 185.199.108.133, 443, 49761, 49762 FASTLYUS Netherlands 22->37 39 github.com 140.82.121.3, 443, 49734, 49735 GITHUBUS United States 25->39 41 avatars.githubusercontent.com 185.199.109.133, 443, 49738, 49739 FASTLYUS Netherlands 25->41 43 consentdeliveryfd.azurefd.net 25->43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 14:52:13 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
25 of 47 (53.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=shdsdpq7xs7ckiqy53mlr2fytrdpjgzg334o727r6mfkvyifk4sq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
013066864283e4be87e7bd39b6e75ef40e98014377d520ffd213a8de2d59923f
AgentTesla
168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3
AgentTesla
72da1e5fdfc57c07501ab49085450aac225737f4eafd1a9a2a2d2ce46f615b19
AgentTesla
98245891a284abcccb56bb8ccd774fbcde277259432b07294d7e3e7b864c30c1
AgentTesla
a1071d7b923717b0ef2dbc6fa2549510f1a4921273828037753c27a77b2abfbe
AgentTesla
b2b6eff8a6c60704b212b98e6eb03be8bd26e1dc3bd8b6f28774bd6a52badb6d
AgentTesla
b9c82068f2880f34b3bf0dfb60d5c14c51d9317845cc58cb181a1e2639a960c4
AgentTesla
dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2
AgentTesla
e769369f1fd04a2fdb3976c69cbaaefee66cee1f54f523d7eab4712ce764f73f
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
+ 3'024 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210305-krxy9zcgea/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
dec447e93ce344057b0815e72be54c860caa549b588b8cf8481f4923bdee6c8c
MD5 hash:
2ad9ddfdf03b067e4fb85dda9b0b0ede
SHA1 hash:
a8c0c3da12b6430608b446fcf7bea14b0aa0b1f7
Link:
https://www.unpac.me/results/74836bca-334e-4ad0-aeb1-15d8522bc595/
SH256 hash:
b525ca6e5460cb3025c36323b21ac3e90d035b40ddeb92cef125936737e03f20
MD5 hash:
ca2ed36111c968aef52892c51f5fe68b
SHA1 hash:
791fa506b43d696090ca6c4da49a26fc0a5232c0
Link:
https://www.unpac.me/results/74836bca-334e-4ad0-aeb1-15d8522bc595/
SH256 hash:
dd4f4cdc0febe0462db1313e7438d3f99f86b01b2ae26ae5d50735d401bb03e9
MD5 hash:
dbf885ddf782840856e0c9c2d2985fe7
SHA1 hash:
913bbca9707554863e52a0236c215b3a9d8c6247
Link:
https://www.unpac.me/results/74836bca-334e-4ad0-aeb1-15d8522bc595/
SH256 hash:
91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725
MD5 hash:
1167c4b794deb28577fd99935b732a34
SHA1 hash:
0b8b879df448e5f4cfba7300a4c3e0bf5ec8b2c8
Link:
https://www.unpac.me/results/74836bca-334e-4ad0-aeb1-15d8522bc595/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5184fd4724fa2efd3e4fa747fb57318bb790c717b8fd903ae3367ecbdb70a125

AgentTesla

Executable exe 91c721be1fbcbe252218eed8b8e8b89c46f49b26def8efebf1f30aaae1055725

(this sample)

  
Dropped by
SHA256 5184fd4724fa2efd3e4fa747fb57318bb790c717b8fd903ae3367ecbdb70a125
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/122404/

Comments