MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b22c89b7538e1da6bdeadb5eab3df9ab4c76de044017db8045d7bb76049945f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b22c89b7538e1da6bdeadb5eab3df9ab4c76de044017db8045d7bb76049945f9
SHA3-384 hash: 3586992e53b2e9f426191bec3068d30689077f5b5bd5d42ffd54ca091452994bdd906eb0d82be686a39a411bdf951710
SHA1 hash: 0d1f27fa3546fdec11516c3357a8281e820cd58e
MD5 hash: 2a0ffb3890a75aba032f61a0297ce7ad
humanhash: single-black-vermont-low
File name:Request For Quotation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:680'960 bytes
First seen:2020-08-17 06:11:15 UTC
Last seen:2020-08-17 07:00:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 90971096b3f3ef49ea4900e0dc05049a (10 x FormBook, 9 x AgentTesla, 4 x Loki)
ssdeep 12288:LgftlTxIDJRRtYRNeuawx2+8zVQLlcqPTxUHYY3UmNUS+HouX:Lg1JxIwP5YxaZ0dD6Skf
Threatray 28 similar samples on MalwareBazaar
TLSH 29E47B32A1E14437D172DA7C9C1B637B982ABD132B3C9B466BE07D485F3BA5036252C7
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: winterfell.networkredux.net
Sending IP: 209.191.187.244
From: Che Ain Zulaikha binti Che Zulkarnain <ainzulaikha@mohazet.com.my>
Subject: Request for quotation
Attachment: Request For Quotation.pdf.z (contains "Request For Quotation.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46638/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Result
Threat name:
AgentTesla GuLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/432554
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect Any.run
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Agent Tesla Trojan
Yara detected AgentTesla
Yara detected GuLoader
Yara detected VB6 Downloader Generic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 268555 Sample: Request For Quotation.exe Startdate: 17/08/2020 Architecture: WINDOWS Score: 100 23 checkip.us-east-1.prod.check-ip.aws.a2z.com 2->23 25 checkip.check-ip.aws.a2z.com 2->25 27 checkip.amazonaws.com 2->27 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Detected unpacking (changes PE section rights) 2->47 49 11 other signatures 2->49 9 Request For Quotation.exe 2->9         started        signatures3 process4 signatures5 59 Maps a DLL or memory area into another process 9->59 12 Request For Quotation.exe 1 9->12         started        process6 signatures7 61 Tries to detect Any.run 12->61 63 Hides threads from debuggers 12->63 15 Request For Quotation.exe 6 12->15         started        process8 dnsIp9 33 googlehosted.l.googleusercontent.com 172.217.168.33, 443, 49725 GOOGLEUS United States 15->33 35 doc-0c-3k-docs.googleusercontent.com 15->35 37 Tries to detect Any.run 15->37 39 Maps a DLL or memory area into another process 15->39 41 Hides threads from debuggers 15->41 19 Request For Quotation.exe 16 15->19         started        signatures10 process11 dnsIp12 29 enmark.com.my 110.4.45.145, 49728, 49736, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 19->29 31 mail.enmark.com.my 19->31 51 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->51 53 Tries to steal Mail credentials (via file access) 19->53 55 Tries to harvest and steal ftp login credentials 19->55 57 Tries to harvest and steal browser information (history, passwords, etc) 19->57 signatures13
Detection:
guloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b22c89b7538e1da6bdeadb5eab3df9ab4c76de044017db8045d7bb76049945f9/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:13:07 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wiwitn2tryo2nppk3npkwppzvnghnxqeial5xacf265xmbezix4q._file
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
1b7e04d537fb0ed215cf1d0d4445def97cae4701c1c889f4e94736e1814d9233
AgentTesla
2bb3ec5f6e8830a1b8e87a95bcb53406688386e7dd33149bb8117318f28faba9
AgentTesla
4f8130693067523c153d09b000e48e744ca3b86388221a840349746ea6e561df
AgentTesla
554da92aa0dff594ff82094b0a8e8125419723e8899c670f7b8d74daf0580880
AgentTesla
70ecffff57ecd39682bc7de003d937b43d0b0c9bfaadd315d236627475608e54
AgentTesla
887de911a26e0008429adcba8abc212d36423fae62d40aa1df57e2883db77d45
AgentTesla
8b013f7d0015d773fb1bd83c18bfd34180dbc1e10beb848fd699420f9f7278ca
AgentTesla
a2a9054cc0ce0c7c53a7fbf11b1ea81e80a3e4d6ccff09e731281807c17791fc
AgentTesla
a9abad7f4aace35de5651f437a83f47787606345d04ea63426db6a7a9b02ba5e
AgentTesla
cf4ee4097cc5954454ca5204a2e12bb7f22890b050fbdbbb8cf467358d36b44b
AgentTesla
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200817-htnz8maer2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b22c89b7538e1da6bdeadb5eab3df9ab4c76de044017db8045d7bb76049945f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z a63561782dcae79b8c5e93765c4e5983b5a747d0506dbd00f9bc6fb91a70b27a

AgentTesla

Executable exe b22c89b7538e1da6bdeadb5eab3df9ab4c76de044017db8045d7bb76049945f9

(this sample)

  
Dropped by
MD5 1c6a8dd19e5da0c6da086d9371066533
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/46638/
  
Dropped by
SHA256 a63561782dcae79b8c5e93765c4e5983b5a747d0506dbd00f9bc6fb91a70b27a

Comments