MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b
SHA3-384 hash: 5eb0ba52b90a619def802ede175fa54128e2e1cdd5c170f666453dd40d058d25d9848fe24c59246d8c5d58914c3352fc
SHA1 hash: bd3ffe5c2f66cd4b378cc0b8a9af2bf7ab073fe7
MD5 hash: 09352e6ffe70e5dd0285aa4e7a45b1af
humanhash: berlin-gee-black-indigo
File name:DOC131020-13102020161809.pdf
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'888 bytes
First seen:2020-10-15 12:56:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:tr0Dx9dBuk7Rxpq8BSvMPIeQFIna2xYXgo8IP5yxh8QO/2eX/GV:tgD/3Jrpq+AKa2BIzP//X/GV
TLSH 51A4BFB27D52587ECA6F077550AA85C1FAB616C73F608B0D71AF430C0E01A2BEB5725B
Reporter abuse_ch
Tags:AgentTesla pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71396/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a window
Running batch commands
Launching a process
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/492475
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Add file from suspicious location to autostart registry
Tries to detect virtualization through RDTSC time measurements
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 298741 Sample: DOC131020-13102020161809.pdf Startdate: 15/10/2020 Architecture: WINDOWS Score: 96 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected AgentTesla 2->37 39 Sigma detected: Add file from suspicious location to autostart registry 2->39 41 3 other signatures 2->41 7 DOC131020-13102020161809.exe 8 2->7         started        11 pcalua.exe 1 2->11         started        13 pcalua.exe 1 1 2->13         started        process3 file4 27 C:\Users\user\AppData\Roaming\...\inte.exe, PE32 7->27 dropped 29 C:\Users\user\...\inte.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\Users\...\DOC131020-13102020161809.exe.log, ASCII 7->31 dropped 33 C:\Users\user\AppData\Local\Temp\...\Fdf.dll, PE32 7->33 dropped 51 Tries to detect virtualization through RDTSC time measurements 7->51 15 cmd.exe 1 7->15         started        17 inte.exe 2 7->17         started        19 inte.exe 3 11->19         started        signatures5 process6 signatures7 22 reg.exe 1 1 15->22         started        25 conhost.exe 15->25         started        43 Multi AV Scanner detection for dropped file 19->43 45 Machine Learning detection for dropped file 19->45 47 Tries to detect virtualization through RDTSC time measurements 19->47 process8 signatures9 49 Creates an autostart registry key pointing to binary in C:\Windows 22->49
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 09:41:16 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ssjdfo7t3y6ivylsfe6pjycrsecxbtqk66hxzi6ndfkymaok4nfq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201015-kzgkva9vca/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b
MD5 hash:
09352e6ffe70e5dd0285aa4e7a45b1af
SHA1 hash:
bd3ffe5c2f66cd4b378cc0b8a9af2bf7ab073fe7
Link:
https://www.unpac.me/results/556dae9f-cdf4-4ce9-84b8-6f7f312375e9/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/556dae9f-cdf4-4ce9-84b8-6f7f312375e9/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
615969ada6ce23fb842b1d84c1c61c283746284913ec93dcb69ad87a262f4fb0
MD5 hash:
ae0e5dd06c7b9b00ccab5ea3c38ecd17
SHA1 hash:
f04a41f072479daab85622d236a823b048ba7d55
Link:
https://www.unpac.me/results/556dae9f-cdf4-4ce9-84b8-6f7f312375e9/
SH256 hash:
6d29f8489464ba328fba609fe40684964660de231003def0df826f3396deecca
MD5 hash:
7ac38f8458cd4965cb3ec5562b553671
SHA1 hash:
c6d42a009ce711be7fc9e9e925d66859fa5c4626
Link:
https://www.unpac.me/results/556dae9f-cdf4-4ce9-84b8-6f7f312375e9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 949232bbf3de3c8ae172293cf4e051910570ce0af78f7ca3cd19558601cae34b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71396/

Comments