MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7
SHA3-384 hash: 50b396cbc5d807e73d1f0396817f43e44d088f12fda0f2608edf68aea60c825f00680687cf78522acf0f132e3c366a71
SHA1 hash: f76ff6d84f5a655b034ada8a92131f1a68f31606
MD5 hash: 39998ab0dacf02d116d78238238515a7
humanhash: mississippi-cola-fanta-april
File name:Siparişi_(PO4035247)_Sentes-BIR A.S..exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:694'784 bytes
First seen:2023-09-22 14:59:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:ktHUZrD6kPwe/LA+wqjd9x1hW4ZcpCnEpxe5PijIV4kIbPTDcajCO/043k:dxDZY8XhdD1bpL4kIbPPcEBk
Threatray 5'852 similar samples on MalwareBazaar
TLSH T14AE41217B28C6F1EEA7D4A76743542B18238FE431892F35C7CC4FA5D96732A88851AD3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 0f2f0f1f271b6931 (13 x AgentTesla, 3 x StormKitty, 2 x Formbook)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Siparişi_(PO4035247)_Sentes-BIR A.S..exe
Verdict:
No threats detected
Analysis date:
2023-09-22 15:01:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6a72f821-cba5-4fe0-8ec3-a7fc4ae83c5d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/450640/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.18888.13997.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/650dabf6ac6222a2be154425/reports/9cbe5e50-6286-4150-84c1-679b77148b99/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4be4fc76-eefa-4705-85b1-52a411ab916a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1312979
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1312979 Sample: Sipari#U015fi_(PO4035247)_S... Startdate: 22/09/2023 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 7 other signatures 2->59 7 Sipari#U015fi_(PO4035247)_Sentes-BIR_A.S..exe 4 2->7         started        10 YawnMo.exe 3 2->10         started        12 YawnMo.exe 2->12         started        process3 signatures4 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->61 63 Adds a directory exclusion to Windows Defender 7->63 65 Injects a PE file into a foreign processes 7->65 14 Sipari#U015fi_(PO4035247)_Sentes-BIR_A.S..exe 2 5 7->14         started        19 powershell.exe 19 7->19         started        67 Multi AV Scanner detection for dropped file 10->67 69 Machine Learning detection for dropped file 10->69 21 YawnMo.exe 2 10->21         started        23 YawnMo.exe 10->23         started        25 YawnMo.exe 12->25         started        process5 dnsIp6 33 zqamcx.com 78.110.166.82, 49713, 49716, 49724 UKSERVERS-ASUKDedicatedServersHostingandCo-Location United Kingdom 14->33 35 mail.zqamcx.com 14->35 37 windowsupdatebg.s.llnwi.net 14->37 29 C:\Users\user\AppData\Roaming\...\YawnMo.exe, PE32 14->29 dropped 31 C:\Users\user\...\YawnMo.exe:Zone.Identifier, ASCII 14->31 dropped 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->43 45 Tries to steal Mail credentials (via file / registry access) 14->45 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->47 27 conhost.exe 19->27         started        39 mail.zqamcx.com 21->39 41 mail.zqamcx.com 25->41 49 Tries to harvest and steal browser information (history, passwords, etc) 25->49 51 Installs a global keyboard hook 25->51 file7 signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-09-22 12:35:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
21 of 36 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydshfkiunj4xlnmqr3ujotkj7a2cmyt4wb2bretiswneglfwd2tq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3ec460aeca63f43b1c270d4c2c6d517086e8a302863bac43d7389d519c95f37e
AgentTesla
742db9471549b91bca93f28cb8b9ba804a4fa03346223b57384b62b9a386b124
AgentTesla
760831724396437abbc9df355eff72482e467f43cdd76d426283c86820165e32
AgentTesla
8772e4d4d85468aa0e38f08261a4c2ccce28e6d9b50a8b219f79f228f736c85a
AgentTesla
916c26e1e43c03fb2faff6fe47a65492f0966ea0b5ae7ba4fd864af05f1e6ee8
AgentTesla
9972272899a7a165546fd3c97f1df1c068c658154b947dd234db1a1204d0a484
AgentTesla
a42fc25e5c4b617629fe6867cb6625b17f18625b6a2102343dd51219bcd99760
AgentTesla
c9371309802b12f374c0a8f8e28b1fe40bd72929342338b7fc769f1a845f79a3
AgentTesla
eac955e21979be52d265a31b6d4d7434089ec180b116f5fd70792978ddb87d01
AgentTesla
f4b4e8c5922902a99c7fad1329d23fe90295b08b165200189273f391323dc47c
AgentTesla
+ 5'842 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230922-sdbavsag28/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Unpacked files
SH256 hash:
bb80534b2020ff8b190121d259f6f0f517b945ef8e29b89554c61956c48efac3
MD5 hash:
4ce3fd8661138b0deadc1f3d5b8ca09b
SHA1 hash:
e66191df65480edf57b0c05a013c54502d472ff3
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
Parent samples :
eac955e21979be52d265a31b6d4d7434089ec180b116f5fd70792978ddb87d01
916c26e1e43c03fb2faff6fe47a65492f0966ea0b5ae7ba4fd864af05f1e6ee8
dfba6d9c101eb1273aaf962047fd958424bfac70a1162c2a910640981a23d054
c9371309802b12f374c0a8f8e28b1fe40bd72929342338b7fc769f1a845f79a3
f4b4e8c5922902a99c7fad1329d23fe90295b08b165200189273f391323dc47c
3ec460aeca63f43b1c270d4c2c6d517086e8a302863bac43d7389d519c95f37e
e4b091b6eb1421a4bb8ef19af620e52d101806a44351c5191919198306d6b826
8772e4d4d85468aa0e38f08261a4c2ccce28e6d9b50a8b219f79f228f736c85a
5a6c429f017b403c4bc91330056da43f35387f4a5ed19fed2be140ee29c32989
26eec7bea99973fa7a59366d0603196099cec54b0e20f89876fd1dcbc6ea1e94
234aff0ca0de7675a5bcd4b0925d85bcb9c6df06948159893fdb990274a5164c
d31d25db8f90f851d56eda5ac2e95f0b030c0d42ea908386f52e95ff313bdfc4
7feb4037f4f3a98c88af6a20855d9be48c8f127f5aca54beea08149d78bb4dc1
25fd8be2e2dcbbf3707e4aba7be70e8d962beb4a47c9c4a1763b09086fcb1258
15ba4f63fe43c578c10edea51d3a521efb953302d78621b92ca65e699b921dad
ccfb9a331960621fa51b170c722fa4f6bb7e1cc04db987298af3887fe08bd64f
760831724396437abbc9df355eff72482e467f43cdd76d426283c86820165e32
a42fc25e5c4b617629fe6867cb6625b17f18625b6a2102343dd51219bcd99760
742db9471549b91bca93f28cb8b9ba804a4fa03346223b57384b62b9a386b124
bd0b7ee993da6e96723b57cef78778f681b3682e00aa44c8916c91fbf7b9d058
571b509e7c87384fe9a4933b24cf0d7d8e2c2faa70e39613ba3561259a573df1
9972272899a7a165546fd3c97f1df1c068c658154b947dd234db1a1204d0a484
3a099cd463190175916c58f9f590da65059c3207f6e5e8d5ee7e4615fdecd4d6
17a9e377f1a8abdba24292372a1a4630383438b315b791988ebca48e8f634abc
c70653b62d36bc066f5b9253d3a9f519eca5ff2d58fd39affa1d0e2468186980
44f1236de9be7944b5ee2b19a9b7cda3df8ca686954a464abd509916d54671b1
bb80534b2020ff8b190121d259f6f0f517b945ef8e29b89554c61956c48efac3
05b6b6be781094f149665aaf2991c91fd29485545356771d1515afa6b0da105a
c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7
6e3f981e67d34ae5926687f3cd70f6533dbe42a041a946dd4c0ad51a239b87ee
f5970e4e030d40597a3f67287136f2044c51354e333008c8455c668622ddbfd1
eded555a7a575a6335ccc1c59ac51b58eb00ba3f43a0d5ed66f2af28f4d3bcf6
42d4821835c8d06dec695b9d34f4418097281376fdcb37d85193e89b89ab0dd2
b97373a2cf56a7e34552242194ca53f1afdc4283eadc6b028353d7a546d7fc11
3a835ba5ec5b577df4066e1635d0fd150f189992464836df6400ed6a416cdfd4
7e1956202b29fa1f4b2069bfca66729c92f55a8597f2915713f525d10daee463
SH256 hash:
d4d5678b670977ae70f3797f601836b21e98bbbc875de0509943abd243c046c3
MD5 hash:
d39bd0c2eafcdca7ec6d692631d52ae0
SHA1 hash:
c0f1f6d03116044e3ca7ff8f5425f14b7dd0ac8c
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
SH256 hash:
fd0da15da47e8544de2c23e20e067b4f44cd84724f047b95fc86c66ffbcc9090
MD5 hash:
3515cfdbef47c0394637538088f8a2c8
SHA1 hash:
ad641e81c7fabec80a06c838bc9c02d1b5565337
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
SH256 hash:
631c38cf652447128f262e600cc8783bdcb6d36f77e1d86b37f9fad749f6e997
MD5 hash:
c22c5bef73b2740fc1ccdf0e5a1cb7ea
SHA1 hash:
216ae0a5f45a184d3f62175703183277d93b87b6
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
SH256 hash:
7ec118e70613ce2d9aee29cda2918ca710dde346c68d4da75c2ea0402e6d4391
MD5 hash:
1622a62bf6805b2dca82a8632eceac71
SHA1 hash:
071b72a5a1231149dfe4b9fcfa3a6ee49265ab7c
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
SH256 hash:
c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7
MD5 hash:
39998ab0dacf02d116d78238238515a7
SHA1 hash:
f76ff6d84f5a655b034ada8a92131f1a68f31606
Link:
https://www.unpac.me/results/a1c571f8-32ed-49b9-8923-b9914c494d06/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c0e472a9146a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c0e472a9146a7975b5908ee8974d49f83426627cb074189268959a432cb61ea7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/450640/

Comments