MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60
SHA3-384 hash: a8946ce01c82b29fe18bf3b0a58108017c3f8350a29dfa0d9ba971a0adcb6de92c3728268f63d48a6d2731a34ee19aff
SHA1 hash: 45257ee12ddf488f56f3e41576f93fed12e6ce20
MD5 hash: ad28e18735d8e13304ef1adcf4218cec
humanhash: massachusetts-magnesium-pennsylvania-nebraska
File name:ad28e18735d8e13304ef1adcf4218cec.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:5'797'376 bytes
First seen:2021-12-03 15:51:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 98304:h3aCZkwFQyY43aCZkwFQyYM3aCZkwFQyYU3:hXWKQy3XWKQyTXWKQy
Threatray 865 similar samples on MalwareBazaar
TLSH T1E8467A3C29FD222BD2B9C7B9CBE59867F15499AF3110A96458D3576A0B13E4234C323F
File icon (PE):PE icon
dhash icon 10307cb470f0f0c4 (1 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ad28e18735d8e13304ef1adcf4218cec.exe
Verdict:
Malicious activity
Analysis date:
2021-12-03 15:55:34 UTC
Tags:
installer
Link:
https://app.any.run/tasks/7f1c8757-3b79-4ce0-83f3-e937b524eb32

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/211070/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1011.UNOFFICIAL
Create hunting rule

Win.Packed.Pwsx-9889167-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61aa3d254d8e6f3a5e0d7dbd/reports/8bffb7dd-4fd1-43eb-9686-c9a6bea00ceb/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b48d2c7-e88c-440d-af31-0469dba4b961
Result
Threat name:
Snake Keylogger
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/900970
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Drops PE files to the document folder of the user
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 533444 Sample: JEtNgnM2mn.exe Startdate: 03/12/2021 Architecture: WINDOWS Score: 100 59 193.122.130.0, 49769, 80 ORACLE-BMC-31898US United States 2->59 61 192.168.2.1 unknown unknown 2->61 63 6 other IPs or domains 2->63 83 Malicious sample detected (through community Yara rule) 2->83 85 Antivirus detection for dropped file 2->85 87 Multi AV Scanner detection for dropped file 2->87 89 11 other signatures 2->89 10 JEtNgnM2mn.exe 3 2->10         started        14 Synaptics.exe 2 2->14         started        16 EXCEL.EXE 2->16         started        signatures3 process4 file5 49 C:\Users\user\AppData\...\JEtNgnM2mn.exe.log, ASCII 10->49 dropped 111 Injects a PE file into a foreign processes 10->111 113 Contains functionality to detect sleep reduction / modifications 10->113 18 JEtNgnM2mn.exe 1 6 10->18         started        21 Synaptics.exe 14->21         started        signatures6 process7 file8 39 C:\Users\user\...\._cache_JEtNgnM2mn.exe, PE32 18->39 dropped 41 C:\ProgramData\Synaptics\Synaptics.exe, PE32 18->41 dropped 43 C:\ProgramData\Synaptics\RCX43ED.tmp, PE32 18->43 dropped 45 C:\...\Synaptics.exe:Zone.Identifier, ASCII 18->45 dropped 23 Synaptics.exe 3 18->23         started        26 ._cache_JEtNgnM2mn.exe 15 2 18->26         started        47 C:\ProgramData\...\._cache_Synaptics.exe, PE32 21->47 dropped process9 dnsIp10 99 Multi AV Scanner detection for dropped file 23->99 101 Drops PE files to the document folder of the user 23->101 29 Synaptics.exe 304 23->29         started        33 Synaptics.exe 23->33         started        71 checkip.dyndns.com 132.226.247.73, 49748, 80 UTMEMUS United States 26->71 73 nclanka.lk 162.214.77.81, 49750, 49752, 49754 UNIFIEDLAYER-AS-1US United States 26->73 75 3 other IPs or domains 26->75 103 Antivirus detection for dropped file 26->103 105 May check the online IP address of the machine 26->105 107 Tries to steal Mail credentials (via file / registry access) 26->107 109 Machine Learning detection for dropped file 26->109 signatures11 process12 dnsIp13 77 docs.google.com 172.217.168.46, 443, 49767, 49768 GOOGLEUS United States 29->77 79 freedns.afraid.org 69.42.215.252, 49780, 80 AWKNET-LLCUS United States 29->79 81 xred.mooo.com 29->81 51 C:\Users\user\Documents\~$cache1, PE32 29->51 dropped 53 C:\Users\user\Desktop\JEtNgnM2mn.exe, PE32 29->53 dropped 55 C:\Users\user\Desktop\._cache_Synaptics.exe, PE32 29->55 dropped 57 3 other files (1 malicious) 29->57 dropped 35 ._cache_Synaptics.exe 29->35         started        file14 process15 dnsIp16 65 193.122.6.168, 49753, 80 ORACLE-BMC-31898US United States 35->65 67 172.67.188.154, 443, 49755, 49835 CLOUDFLARENETUS United States 35->67 69 5 other IPs or domains 35->69 91 Antivirus detection for dropped file 35->91 93 Multi AV Scanner detection for dropped file 35->93 95 May check the online IP address of the machine 35->95 97 4 other signatures 35->97 signatures17
Detection:
snakekeylogger
Create hunting rule
Link:
https://mwdb.cert.pl/sample/95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 22:20:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
386
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sutsubyn6lhstcgshajy2hvnz7x742hdchmqj6bzngzp24nwf5qa._file
Verdict:
malicious
Similar samples:
0fbdb66d81f97c74640af563b58b4d93872ed48a0397754b5c51a5c76d32900c
AgentTesla
2331603d506c3775f2faf8fda993a1bba066632b92a5d0fbfb0ed20c680888d6
AgentTesla
26274dd1baa5be91bd6bdb0db48895d89da2a78e6fac273257557de473adc841
AgentTesla
5fa54622d0d5f5abbeec7e634d6c2d868984e8cfb20b8502757c2df8fe94f7c7
AgentTesla
a3cbb98747178f3da58a7d44bbd672c526d1721b20ece7d92f3b85667467aa2b
AgentTesla
b5ec7f78185a787382d36904970a9635691ef6034a9acc501008eb817e11d07e
AgentTesla
fa9e3e8282175677e1bf926361df6aa60510a6ba8d3d8857d9c9cd850d971d60
AgentTesla
+ 855 additional samples on MalwareBazaar
Result
Malware family:
snakekeylogger
Create hunting rule
Score:
  10/10
Tags:
family:snakekeylogger collection keylogger persistence spyware stealer
Link:
https://tria.ge/reports/211203-ta3rdaghgl/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
Snake Keylogger
Unpacked files
SH256 hash:
4f1d5aa7192953d7a759bf927080cef048672135822b56d22ebb8b01b9630912
MD5 hash:
3e581e5b922cc6c13b6dc4895c37d985
SHA1 hash:
124cb2660c93a6fb30bcd0fcc0919f6daf3b3da8
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
b9eae90f8e942cc4586d31dc484f29079651ad64c49f90d99f86932630c66af2
MD5 hash:
c0ef4d6237d106bf51c8884d57953f92
SHA1 hash:
f1da7ecbbee32878c19e53c7528c8a7a775418eb
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
c0ee1071e444f415f8b62856a0896f3b22e563f1bb4f03d14142583efe49a565
MD5 hash:
29db2e114b88ae1f6a00c9aa71690043
SHA1 hash:
ec82db71443556a5b320357b0b8b09e70ec1db9c
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
6e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
MD5 hash:
ba9fe00d326f5997104101d59460e994
SHA1 hash:
46acc8f6c5f441f594d38e7062d63abfd2286807
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
3390b4e53006e7f20d241423552de745e690c5353b2b686830212dbac08d9495
MD5 hash:
f959d292db3cc663fb72f41fe1e2a073
SHA1 hash:
3f7256e1d59d83d156ac01139e44b671813d6691
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
c9eb5d02d5ef3eab72c2775f64d412c2b5cbdb13d137dec34c39b85a3233f40c
MD5 hash:
bda6ac077394f64f9e19d5d48998d039
SHA1 hash:
2b7a3acf366bdc88d272fcd50a657c59ecb2a085
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
SH256 hash:
95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60
MD5 hash:
ad28e18735d8e13304ef1adcf4218cec
SHA1 hash:
45257ee12ddf488f56f3e41576f93fed12e6ce20
Link:
https://www.unpac.me/results/1f629e5c-c3e7-40d4-96c8-5c7baaaf801c/
Malware family:
Phoenix
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/95272a070df2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/211070/

Comments