MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733
SHA3-384 hash: cdbe24c849361a817a8f089cef5a0e32f91ae567f434ca9eef617a88ee4d86a8e104ed7b192b6e736837ae1f26173511
SHA1 hash: 56b929df2ea41c042c02d798b1ad093e45d984f8
MD5 hash: 4ae008c6a21d433c2b372f39ea1d88ab
humanhash: six-venus-network-south
File name:urgent quotation CN# 1400005567.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:553'984 bytes
First seen:2021-11-22 08:16:44 UTC
Last seen:2021-11-22 12:22:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:Ss4tD005GULmn6jIsNooHJXkIg7azc8gWa0+8YVAQaoDcc:Ss4C05GUan6jIsuoHJXTg7HW3JGAsDF
Threatray 12'883 similar samples on MalwareBazaar
TLSH T199C4F1603618634AD82D8FB5CC3D81853B3165D12618C6DD6CBBE38E6E75B076722BB3
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
urgent quotation CN# 1400005567.exe
Verdict:
Malicious activity
Analysis date:
2021-11-22 08:57:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b200e6e4-6af9-4f52-9a04-671094314f75

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.20148.4071.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Creating a window
DNS request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/619b5202398e2553d2009052/reports/c953f544-8cd3-484f-b50c-d0df40b7a6a0/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a53e0ba-dff2-4e20-81f4-2181c3f03c18
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/893653
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 526132 Sample: urgent quotation CN# 140000... Startdate: 22/11/2021 Architecture: WINDOWS Score: 100 30 clientconfig.passport.net 2->30 32 adl.windows.com 2->32 34 a-0019.a.dns.azurefd.net 2->34 40 Found malware configuration 2->40 42 Multi AV Scanner detection for dropped file 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 11 other signatures 2->46 8 urgent quotation CN# 1400005567.exe 7 2->8         started        signatures3 process4 file5 24 C:\Users\user\AppData\Roaming\hXVGUKC.exe, PE32 8->24 dropped 26 C:\Users\user\AppData\Local\...\tmpA466.tmp, XML 8->26 dropped 28 urgent quotation CN# 1400005567.exe.log, ASCII 8->28 dropped 48 Adds a directory exclusion to Windows Defender 8->48 12 urgent quotation CN# 1400005567.exe 2 8->12         started        16 powershell.exe 22 8->16         started        18 schtasks.exe 1 8->18         started        signatures6 process7 dnsIp8 36 medicare-equipment.com 192.185.84.191, 49786, 587 UNIFIEDLAYER-AS-1US United States 12->36 38 mail.medicare-equipment.com 12->38 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->50 52 Tries to steal Mail credentials (via file / registry access) 12->52 54 Tries to harvest and steal ftp login credentials 12->54 56 2 other signatures 12->56 20 conhost.exe 16->20         started        22 conhost.exe 18->22         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 06:48:45 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xt5qrdn2wxzpogwtvzmrl7zmcolvyyjsi72el56mws7azjzgw4zq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
396ec927c30631ad8ae06517d0508bc5cc5d94ccd0d73c819815b5ea5c688628
AgentTesla
4a02298fbd57972ec5702a4969b5f8320beb3de08846d083afda00385dc9d48d
AgentTesla
6cdc8b267c695613fbe66deb0ea00e36598109dde263963c9f3192d447dd23e8
AgentTesla
904f9d09f6729501708bff5b7d690e25a69025f4a2ae207996db9f97670d0748
AgentTesla
a405d21e949820c60152a4c587f6d68892c94ddab64716b2e3fbea3a78eaf8e0
AgentTesla
b452666cd2b4f6f34f8e992aa7e2243b717fc912559e7d8c792cf1e00e996b64
AgentTesla
c58580b14cb6255d0d21086e02557b7ab1ebcfb742fe732225a36766cc10893d
AgentTesla
e31e440c5c9ead32744cc40730f22d0470b36416b428a4a14fa7d6f9c7af5499
AgentTesla
+ 12'873 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211122-j6p52sfahn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5cdd379776031706c70f6bdcc0f246768e17c77d3c33067692b33b37557aa5c3
MD5 hash:
c71c6f388fcea879c11e9c9b439c37e7
SHA1 hash:
a71b52aa801253bbc5edb8e6e8237c6a99e2a615
Link:
https://www.unpac.me/results/b2e13f6a-141f-45f6-8cda-a803a7a23ad8/
SH256 hash:
0b6638e8778d002e664a743ae12b74987a74ca9b655857cc5baca409c43b4792
MD5 hash:
967e4d1b12a531aa602f0f3f06bbfc76
SHA1 hash:
0dc8ceb67858e11cc736d6168c9ff148d8644c32
Link:
https://www.unpac.me/results/b2e13f6a-141f-45f6-8cda-a803a7a23ad8/
SH256 hash:
f30ca642597c059f9dbcc6cfea27687245fbcaf5456be0b7a4528d946f3a0a05
MD5 hash:
0f6349011cf5446131faf0cadbace87b
SHA1 hash:
0cd48b5cb5a0ca095043c333c9002ba5273e92e8
Link:
https://www.unpac.me/results/b2e13f6a-141f-45f6-8cda-a803a7a23ad8/
SH256 hash:
bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733
MD5 hash:
4ae008c6a21d433c2b372f39ea1d88ab
SHA1 hash:
56b929df2ea41c042c02d798b1ad093e45d984f8
Link:
https://www.unpac.me/results/b2e13f6a-141f-45f6-8cda-a803a7a23ad8/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bcfb088dbab5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe bcfb088dbab5f2f71ad3ae5915ff2c13975c613247f445f7ccb4be0ca726b733

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/208051/

Comments