MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4
SHA3-384 hash: f74d5fc92278acc34af553a9ec0f9ffd17fb620af532bccd233d2a9ed9bbef5aea3b656c66b48240196487f5c47c30e7
SHA1 hash: ee6ffbded2791abc58611802f9804b9285766b1a
MD5 hash: 12f951406d26618833a23b119f917853
humanhash: mexico-uranus-echo-saturn
File name:9350769005.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'138 bytes
First seen:2022-11-11 14:09:41 UTC
Last seen:2022-11-21 11:21:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki)
ssdeep 6144:MEa0NT5fCzCWnmY/ErGklpbIBQ6ao977s2uz3eLMZbE8+gry64OaiEdqX80bjP8N:XOCWnNcDbIBQZo977s2uzOLMLdryIaiW
Threatray 19'792 similar samples on MalwareBazaar
TLSH T1BC7412BB26C165EBE4D30D3218E18336C7B05E6A373AA5836B643C37DAB730794652C1
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
9350769005.exe
Verdict:
Malicious activity
Analysis date:
2022-11-11 14:12:49 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/89df732a-0f46-4e67-9d7c-566cfc5e8e88

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332494/
Detection(s):
SecuriteInfo.com.Gen.Variant.Nemesis.2230.8042.26572.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Сreating synchronization primitives
DNS request
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook lokibot nemesis overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/636e57bc20a0b4943a8ee95c/reports/0b9b6f6b-1d4b-4baf-8146-76aa94e31896/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8fecf43c-3662-434b-b5a4-5a595bbac40d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1111318
Signature
.NET source code contains very large array initializations
Creates multiple autostart registry keys
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 744014 Sample: 9350769005.exe Startdate: 11/11/2022 Architecture: WINDOWS Score: 100 70 Malicious sample detected (through community Yara rule) 2->70 72 Multi AV Scanner detection for submitted file 2->72 74 Yara detected AgentTesla 2->74 76 3 other signatures 2->76 7 9350769005.exe 18 2->7         started        10 vldbyflsysc.exe 2->10         started        13 vldbyflsysc.exe 2->13         started        process3 file4 30 C:\Users\user\AppData\Local\Temp\vmjyh.u, DOS 7->30 dropped 32 C:\Users\user\AppData\Local\Temp\isafdb.exe, PE32 7->32 dropped 15 isafdb.exe 1 2 7->15         started        78 Multi AV Scanner detection for dropped file 10->78 80 Detected unpacking (creates a PE file in dynamic memory) 10->80 82 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->82 86 3 other signatures 10->86 19 vldbyflsysc.exe 14 3 10->19         started        84 Maps a DLL or memory area into another process 13->84 22 vldbyflsysc.exe 3 13->22         started        24 vldbyflsysc.exe 13->24         started        signatures5 process6 dnsIp7 34 C:\Users\user\AppData\...\vldbyflsysc.exe, PE32 15->34 dropped 54 Multi AV Scanner detection for dropped file 15->54 56 Detected unpacking (creates a PE file in dynamic memory) 15->56 58 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->58 68 5 other signatures 15->68 26 isafdb.exe 17 4 15->26         started        36 54.91.59.199, 443, 49698 AMAZON-AESUS United States 19->36 38 192.168.2.1 unknown unknown 19->38 44 3 other IPs or domains 19->44 40 52.20.78.240, 443, 49700 AMAZON-AESUS United States 22->40 42 mail.indembcairo.com 22->42 46 2 other IPs or domains 22->46 60 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->60 62 Tries to steal Mail credentials (via file / registry access) 22->62 64 Tries to harvest and steal ftp login credentials 22->64 66 Tries to harvest and steal browser information (history, passwords, etc) 22->66 file8 signatures9 process10 dnsIp11 48 mail.indembcairo.com 41.187.100.9, 49697, 49699, 49701 NOOR-ASEG Egypt 26->48 50 api.ipify.org.herokudns.com 3.232.242.170, 443, 49696 AMAZON-AESUS United States 26->50 52 api.ipify.org 26->52 88 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->88 90 Tries to steal Mail credentials (via file / registry access) 26->90 92 Creates multiple autostart registry keys 26->92 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-11-11 04:16:40 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ul4qknjhjplfto7alykyesoy5n3gw5p5qa6augs2vtnd7aepnc2a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e5b0d318b1bfd14a705e7b4c16324a2e7f21562052948426d11c32ec586be5e
AgentTesla
1c220e85384289de8d43ef19cbb91ab72dd48d4726d90e58ee4ac5dfba40a996
AgentTesla
6a11cc4a941a3406dbe63e9f5e643b01fe5bb678f221fec4b94a0a527b444b9e
AgentTesla
97fcc009023f7c73c58610323abc809a51ec65afa2a6a54abf3e00187f2aaae4
AgentTesla
b6a7e17e7a419a7627495bda74f392db350508a36cc2a089342374e343fe0a06
AgentTesla
eef6df577e7da107e24b1c043d08c10ede909e73ef8d6b6881dd75327770aa7e
AgentTesla
+ 19'782 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221111-rgpf8aag9v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Gathering data
Unpacked files
SH256 hash:
89838316f31830f59cd0aaa83f020618e7d4c913299184cf191c7511197a1043
MD5 hash:
12c1ecca42abdd5f2e9c595260f19ea8
SHA1 hash:
3bbc969b43ec1058dc72d490ee77202f0b4384e1
Link:
https://www.unpac.me/results/f407be94-1c64-4de2-b86c-f33212da4f1c/
SH256 hash:
aebfb9f0874e07b48942ff178b19345a97e2f90d5ff7ae90d57d586b95d34085
MD5 hash:
f95707dea8164e4b6e85f0c7c70edca5
SHA1 hash:
21ce3bce8db06baabc18dad96e8af9dba2be1619
Link:
https://www.unpac.me/results/f407be94-1c64-4de2-b86c-f33212da4f1c/
SH256 hash:
a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4
MD5 hash:
12f951406d26618833a23b119f917853
SHA1 hash:
ee6ffbded2791abc58611802f9804b9285766b1a
Link:
https://www.unpac.me/results/f407be94-1c64-4de2-b86c-f33212da4f1c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_AgentTesla_d3ac2b2f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/332494/

Comments