MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1
SHA3-384 hash: 046d6504517633fd942aaddcc16594599a81c97ef975a56f682918547ef6ad40b1a975faca9173f90addc3c72acc8e09
SHA1 hash: a032dbc479373fd7a917dab871a744ddbb527dce
MD5 hash: d5f53ea37a0ac4fdc93d8ea61312c57c
humanhash: hotel-fish-zebra-ohio
File name:M4 Contracting DUBAI P.O.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:652'800 bytes
First seen:2022-05-25 07:17:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'653 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:YyjEu5eW0GZFFR0B7Nf408PBfgDCe7EXtUmSN0xnhbpf07HzL603VVlE4ba:JjEu/ENfR85Yl7EKmFnVpc7H/6k64ba
TLSH T1BDD423014398A739E8FE4F725D6494D407F8B686B912D7DDCE4B71CA89B37020BA139B
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
M4 Contracting DUBAI P.O.exe
Verdict:
Malicious activity
Analysis date:
2022-05-25 07:23:43 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/52f0dddc-9404-4e36-8880-b0f77a095abb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/274374/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed update.exe
Link:
https://www.filescan.io/uploads/628dd844efe9af159cbc5aad/reports/dbd53757-4404-4b6b-8adf-c5f974306ab5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/834f3a61-17bb-485b-80c3-26d9277f632f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1001328
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 633824 Sample: M4 Contracting DUBAI P.O.exe Startdate: 25/05/2022 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 8 other signatures 2->40 7 M4 Contracting DUBAI P.O.exe 7 2->7         started        process3 file4 24 C:\Users\user\AppData\Roaming\gkSUSu.exe, PE32 7->24 dropped 26 C:\Users\user\AppData\Local\...\tmp916A.tmp, XML 7->26 dropped 28 C:\Users\...\M4 Contracting DUBAI P.O.exe.log, ASCII 7->28 dropped 42 Writes to foreign memory regions 7->42 44 Adds a directory exclusion to Windows Defender 7->44 46 Injects a PE file into a foreign processes 7->46 11 RegSvcs.exe 2 7->11         started        16 powershell.exe 24 7->16         started        18 schtasks.exe 1 7->18         started        signatures5 process6 dnsIp7 32 mail.silicainfotech.co.in 67.222.18.82, 49744, 587 PRIVATESYSTEMSUS United States 11->32 30 C:\Windows\System32\drivers\etc\hosts, ASCII 11->30 dropped 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->48 50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->50 52 Tries to steal Mail credentials (via file / registry access) 11->52 54 4 other signatures 11->54 20 conhost.exe 16->20         started        22 conhost.exe 18->22         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 05:09:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2osa32zyotq47yfi6hnr3b77zvv7yem4hbuzsg2mws4gdsl57iq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220525-h4x77scfem/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
c720d8d87e5744ef459c160ae3ae85984519c5cee89d4acd3d4156f929ebcca2
MD5 hash:
86f922d84e1b89f646bc23cb3d878a9c
SHA1 hash:
b61f4401c1a144d704988cf4e55dd9a71f8d8263
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
SH256 hash:
88263986a370dd81810614b73cc2b5560c774af48be536f4ecf2ba65fea5e447
MD5 hash:
49f1accc0d6b2e62d37bca767d5a5f9f
SHA1 hash:
a2c5deb4d03f431b277fdf8e685332d0b09dbeb9
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
SH256 hash:
0283941f1f7ae72f88bb3044addc3f4274549c3fd771612ec3df95c80b708c9e
MD5 hash:
abcf7824b477074db7ac154a80d1e329
SHA1 hash:
9c6982829bff318776560846de7bcc39d3c16f7f
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
SH256 hash:
af90216eda94ddd115aa7f7445514114ba6222674990a44b76d09f2c1a096f85
MD5 hash:
2f29c0012e0435d0288ad87e872618b1
SHA1 hash:
829f48de0d0f7f31021f6917525f6cab50cc1bd4
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
SH256 hash:
1b384a3f6a36249643d639a338b263f5fe53c9ca5eca49826f4247e459117856
MD5 hash:
a46c9c0b3b718ca55ba707da69b280a4
SHA1 hash:
3cee1790ff61d5a880a1447d435cd794825caabb
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
SH256 hash:
be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1
MD5 hash:
d5f53ea37a0ac4fdc93d8ea61312c57c
SHA1 hash:
a032dbc479373fd7a917dab871a744ddbb527dce
Link:
https://www.unpac.me/results/a19f7f4a-f738-4b10-b2cd-9263511cb90f/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/be9d206f59c3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe be9d206f59c3a70e7f05478ed8ec3ffe6b5fe08ce1c34cc8da65a5c30e4befd1

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/274374/

Comments