MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 becce660f30ed92b6624d5aa1f4917429c732a50852e892a8edf05f41180c23a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: becce660f30ed92b6624d5aa1f4917429c732a50852e892a8edf05f41180c23a
SHA3-384 hash: 81837e5e90182cc4963ad1b9b62094880f3a0a999c30f99204d654f0693985b13471158a393e8b8006409849b2887867
SHA1 hash: 43254c1d126da51b14a92c670838ff8f6c88d309
MD5 hash: d3194c6fa476f1fd584b9e7722eb5bc8
humanhash: xray-emma-nitrogen-sixteen
File name:SecuriteInfo.com.W32.AIDetectNet.01.6090.20110
Download: download sample
Signature AgentTesla
Create hunting rule
File size:206'512 bytes
First seen:2022-06-02 16:36:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:k2RydWnfXAiI3uAs6s5j3dhBw2Vsx7z9/DTPLSmZbvQ6FffPWDK0M1IdCW2cg:9yEfAiI+Ars55YLB/u6rWDLd7g
Threatray 17'836 similar samples on MalwareBazaar
TLSH T1E614011276839E10D89E2E3750C6411927B5E781BAABCF17382DB21CC7833D73A6869D
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter SecuriteInfoCom
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
396
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.W32.AIDetectNet.01.6090.20110
Verdict:
Malicious activity
Analysis date:
2022-06-02 16:41:47 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/8923840f-aa9c-4a73-b864-a5e086d241d2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276358/
Detection(s):
SecuriteInfo.com.W32.AIDetectNet.01.6090.20110.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Creating a window
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated overlay packed replace.exe
Link:
https://www.filescan.io/uploads/6298e7438f4ade68c4e99936/reports/931eee2d-f124-45a2-b4bc-db51d6f940d4/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f3d0a70-a441-44d6-9904-27eaaf78f6df
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1005871
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 638367 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 02/06/2022 Architecture: WINDOWS Score: 100 22 Found malware configuration 2->22 24 Malicious sample detected (through community Yara rule) 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 6 other signatures 2->28 6 SecuriteInfo.com.W32.AIDetectNet.01.6090.exe 1 2->6         started        process3 file4 18 SecuriteInfo.com.W...Net.01.6090.exe.log, ASCII 6->18 dropped 30 Writes to foreign memory regions 6->30 32 Allocates memory in foreign processes 6->32 34 Injects a PE file into a foreign processes 6->34 10 cvtres.exe 2 6->10         started        14 cvtres.exe 6->14         started        16 cvtres.exe 6->16         started        signatures5 process6 dnsIp7 20 mail.privateemail.com 198.54.122.135, 49769, 587 NAMECHEAP-NETUS United States 10->20 36 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->36 38 Tries to steal Mail credentials (via file / registry access) 10->38 40 Tries to harvest and steal ftp login credentials 10->40 42 Tries to harvest and steal browser information (history, passwords, etc) 10->42 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->46 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/becce660f30ed92b6624d5aa1f4917429c732a50852e892a8edf05f41180c23a/
Threat name:
ByteCode-MSIL.Trojan.RealProtect
Create hunting rule
Status:
Malicious
First seen:
2022-06-02 16:37:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3gomyhtb3mswzre2wvb6sixikohgksqquxiskuo34c7iemayi5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
00dbfa467ef14cab6eb8cd82c787f0694be146972fa82ecba2c243b170125e6f
AgentTesla
0edd73b38c89b8fc1462b04e38c1844f7bc4a8b7602015925006c9903ed09f8e
AgentTesla
386d1d77650707bdbaae831b56662183b946b8c8588ec5860f1bede73b05f9a4
AgentTesla
48bc7d857e4ba3e1945c01521208ae667a9bfd8d091efa22d25cfb853bc0001a
AgentTesla
4f4049d0337ec1622ae8f47dc4aaf765dc4058c0a34dde7448b62aa5cacddb9a
AgentTesla
782df41da291585e83635dff168dd75451ca5e103a922a27c174c01830efbb20
AgentTesla
96251a48b4cb322313739923f2eead468447add9b229674865f374ad4b6dd2ab
AgentTesla
f37a0441c66222c49723f8feae71cdce91423549228a852fb24a99fcb80c5e41
AgentTesla
+ 17'826 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220602-t4ss9sgha4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla
Unpacked files
SH256 hash:
04ee794dbd271dc1f67797c2752359cc1d0e05645507b8673f7b7680f3f5abec
MD5 hash:
0a29b1b9e65fd62eed12bfc79969c42f
SHA1 hash:
e85b67ff92b744b40283000d451e0f2f9eb4f6e3
Link:
https://www.unpac.me/results/957982e8-4fda-414e-8a9c-67fb5d5d2ca8/
SH256 hash:
2877906b96d6c1188a55f976531c60fcfeb1a5df46437bf8ca2a353180717c3d
MD5 hash:
16a849591b59267adf486ef538add918
SHA1 hash:
4945b1a3e5030bd2f587131a2350a78b15d41b4c
Link:
https://www.unpac.me/results/957982e8-4fda-414e-8a9c-67fb5d5d2ca8/
SH256 hash:
becce660f30ed92b6624d5aa1f4917429c732a50852e892a8edf05f41180c23a
MD5 hash:
d3194c6fa476f1fd584b9e7722eb5bc8
SHA1 hash:
43254c1d126da51b14a92c670838ff8f6c88d309
Link:
https://www.unpac.me/results/957982e8-4fda-414e-8a9c-67fb5d5d2ca8/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/becce660f30e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/becce660f30ed92b6624d5aa1f4917429c732a50852e892a8edf05f41180c23a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BAZT_B5_NOCEXInvalidStream
Create hunting rule
Rule name:NETDIC208_NOCEX
Create hunting rule
Rule name:NETDIC208_NOCEX_NOREACTOR
Create hunting rule
Rule name:NETDIC_208
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/276358/

Comments