MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031
SHA3-384 hash: b0f825ef251d51eea63973689c0e8aa35ff052f81a5c94000d6399650238d1473543994e030a9c58c31535c3dd515267
SHA1 hash: c6d5c7a323b21c701455f60dca36b9c5e9a5c718
MD5 hash: b094cb699d268cb041e1849019f202f7
humanhash: potato-aspen-victor-yankee
File name:Albaraka Türk İnternet Şubesi E-Dekontunuz.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:832'512 bytes
First seen:2021-09-27 08:21:49 UTC
Last seen:2021-09-28 18:43:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:k3tAU8iqSTiUryXbLUrMjgY6WDWAxXkdarHujnoaLOAZ1saYexL+DQnmLDMhhPsd:00IFSD4R0RWzkvpF72C0LCF+P+V
Threatray 10'262 similar samples on MalwareBazaar
TLSH T1A405BF09636C9F4EC6BF87FAB04341180376E9473E4DD60A9EC670E81EB5BB14A4758B
File icon (PE):PE icon
dhash icon 609e696169701000 (17 x AgentTesla, 5 x Formbook, 2 x SnakeKeylogger)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Albaraka Türk İnternet Şubesi E-Dekontunuz.pdf.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-27 08:28:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/536d55f5-3582-4d83-978f-5cd2581fb53e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191949/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1048.7237.6910.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89a80e55-9c58-4b26-8c9a-96927aaf61ad
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/858736
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 491164 Sample: Albaraka T#U00fcrk #U0130nt... Startdate: 27/09/2021 Architecture: WINDOWS Score: 100 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected AgentTesla 2->41 43 Yara detected Telegram RAT 2->43 45 11 other signatures 2->45 7 Albaraka T#U00fcrk #U0130nternet #U015eubesi E-Dekontunuz.pdf.exe 4 2->7         started        11 kmk.exe 3 2->11         started        13 kmk.exe 2->13         started        process3 file4 25 Albaraka T#U00fcrk...ontunuz.pdf.exe.log, ASCII 7->25 dropped 47 Adds a directory exclusion to Windows Defender 7->47 49 Injects a PE file into a foreign processes 7->49 15 Albaraka T#U00fcrk #U0130nternet #U015eubesi E-Dekontunuz.pdf.exe 2 5 7->15         started        19 powershell.exe 25 7->19         started        51 Multi AV Scanner detection for dropped file 11->51 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->55 21 kmk.exe 2 11->21         started        signatures5 process6 file7 27 C:\Users\user\AppData\Roaming\kmk\kmk.exe, PE32 15->27 dropped 29 C:\Users\user\...\kmk.exe:Zone.Identifier, ASCII 15->29 dropped 31 Tries to steal Mail credentials (via file access) 15->31 33 Tries to harvest and steal browser information (history, passwords, etc) 15->33 35 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->35 37 Installs a global keyboard hook 15->37 23 conhost.exe 19->23         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 08:15:32 UTC
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wllfa5qktlsykdou2wwm34ockkzws5wlkqa5kcwe6b7a373vaayq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0977a8fcfc104e2ab162f63f36e287f7f004f0187fb4c2a9dc0841bfbc4a0975
AgentTesla
76d2b2fe45e16137a7efe7400d8234516163ae9604cce1f10584d53f3907e9a1
AgentTesla
7f3bc638d00a6b3fd61d768fd39047fc87b97942d809d16042770d42d0e0da24
AgentTesla
bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43
AgentTesla
c2a00bec88846bdb15410f9a61ab420963ba0a656a599991ce059adde1a381a3
AgentTesla
c810e257ac876cb505d076efee941037f5f9fd11464a4af8515d0fbac61509b1
AgentTesla
f9c716c3b4b1144cc071f6056628f3f9c7fc05f20f17697b727804826ad03d3b
AgentTesla
+ 10'252 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210927-j9la9sgbc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Unpacked files
SH256 hash:
9a4b34f628dca9815fb3bdb83adfb9e310abb9cdda3c85a0282eb2bf67d0a357
MD5 hash:
37417ebe6a80448a0e10c0104d154b7f
SHA1 hash:
5f6e1df112f39c1d902a954fa4f5a35003332aad
Link:
https://www.unpac.me/results/3c0a97cd-b10b-42d4-8831-ec341465a1e9/
SH256 hash:
f44a6eb80b36ce2c85aa518c8e01313d00ed5f5d3f59371a659412b01129f367
MD5 hash:
111459714dd64ea6d784e71f1105aafc
SHA1 hash:
4e28a738b927dde4e31b840cfa41b3c86083f448
Link:
https://www.unpac.me/results/3c0a97cd-b10b-42d4-8831-ec341465a1e9/
Parent samples :
24ba16885e8cc1052640b95b43ee08c42483e1d0dadb4a10c4b87ad507d9c305
f44a6eb80b36ce2c85aa518c8e01313d00ed5f5d3f59371a659412b01129f367
a4f9e3a3944e87a7cf9eca4f206b2ed7d41361179fee32006e5bf9882f8e9855
54d629d1bbdc3dc634692b74936cabedbce47b088e07878229458b7d5acf79cd
SH256 hash:
dbce690474ec90218490b0917d7f76c830f7a841caf0b73aaf463e20fc7ac920
MD5 hash:
f955b021d13e766af837c66f538de2e8
SHA1 hash:
1aa5682386a8185f35eca4445a834ed7b8d7cf8a
Link:
https://www.unpac.me/results/3c0a97cd-b10b-42d4-8831-ec341465a1e9/
SH256 hash:
efd2f7657839b252c2fb8489c1ccf610b8e57b471efe049de86a74bc1506775d
MD5 hash:
c3f3e4a9e9ab54bf847a9fc02e7a2160
SHA1 hash:
0853bec33e36ede763927cda0f03129ca763bc07
Link:
https://www.unpac.me/results/3c0a97cd-b10b-42d4-8831-ec341465a1e9/
SH256 hash:
b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031
MD5 hash:
b094cb699d268cb041e1849019f202f7
SHA1 hash:
c6d5c7a323b21c701455f60dca36b9c5e9a5c718
Link:
https://www.unpac.me/results/3c0a97cd-b10b-42d4-8831-ec341465a1e9/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b2d650760a9a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b2d650760a9ae5850dd4d5accdf1c252b36976cb5401d50ac4f07e0dff750031

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/191949/

Comments