MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a32fc63620a1e241cf228c8b9f46ba4fe723d3775134d000472e1d91fae35801. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a32fc63620a1e241cf228c8b9f46ba4fe723d3775134d000472e1d91fae35801
SHA3-384 hash: e986adf581a09228a24a459df3833d77d6044a21067cdc30d5a41b784f45df9bd48632fa056f370d77cf435b4ad46170
SHA1 hash: fe341f7d8556fe64e19a851083739c71e8e94e81
MD5 hash: 4ace5ef9e69783e020b9664d1f0ce061
humanhash: hot-single-stream-orange
File name:RFQ#THFS767UT_pdf.scr.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'199'104 bytes
First seen:2020-12-01 15:04:15 UTC
Last seen:2020-12-01 16:51:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:vKgldncmBOPJRtaNmcLrzMi3bXrHsMKXrZBtaswqPWYF:plJtoUkwrzHrXrMRtaswqeY
TLSH 784568F0ED6BD844C16A0AF5C49CD14C4E21EF5B076AEE08A944F3C9197279CC9DA6F2
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/106263/
Detection(s):
SecuriteInfo.com.Generic.mg.4ace5ef9e69783e0.2525.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/552491
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a32fc63620a1e241cf228c8b9f46ba4fe723d3775134d000472e1d91fae35801/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-12-01 15:03:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=umx4mnrauhredtzcrsfz6rv2j7tshu3xke2naachfyozd6xdlaaq._file
Verdict:
unknown
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201201-w5eh36x7jx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/8371e598-8e7c-435c-9531-b62510c00e03/
SH256 hash:
0416bd70febb313a460a1c00da0b0c238c944e86f173cbd63c749fbb885f3887
MD5 hash:
89f81b070fb0346ee5e180d70ef070cf
SHA1 hash:
a3fe471ee7f97ec88850f227e5634dcc555b8a74
Link:
https://www.unpac.me/results/8371e598-8e7c-435c-9531-b62510c00e03/
SH256 hash:
221696775a5a386650e8c366f0788661f242fc79bd277849310d82bc8aebc315
MD5 hash:
81d1f7afdf4a6bced50dfb40b31781ec
SHA1 hash:
ababa11702d7eb003d4fd243c0e405562d24c2dd
Link:
https://www.unpac.me/results/8371e598-8e7c-435c-9531-b62510c00e03/
SH256 hash:
a32fc63620a1e241cf228c8b9f46ba4fe723d3775134d000472e1d91fae35801
MD5 hash:
4ace5ef9e69783e020b9664d1f0ce061
SHA1 hash:
fe341f7d8556fe64e19a851083739c71e8e94e81
Link:
https://www.unpac.me/results/8371e598-8e7c-435c-9531-b62510c00e03/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a32fc63620a1e241cf228c8b9f46ba4fe723d3775134d000472e1d91fae35801

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/106263/

Comments