MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca
SHA3-384 hash: 23b3c0cb09383f3ebedab76767f3c88fc524478a39cd5b372a0c9812387e43be95c5a74dc0142568de724e6658a53b56
SHA1 hash: c923567554d5160ce1b2528300a06a84943e2dbe
MD5 hash: 60c40f266129407afdf825322b69dcb3
humanhash: helium-twenty-echo-july
File name:60c40f266129407afdf825322b69dcb3.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:521'216 bytes
First seen:2022-06-23 06:01:12 UTC
Last seen:2022-06-23 06:55:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:EikPRxliW1WSSlZd3UqaUFst9DNl1LBFL6E9wTr9+H6sztyAF1:EikPRrhWSSlZxUrYSZLPL+rPszQAP
Threatray 18'712 similar samples on MalwareBazaar
TLSH T187B4128467F94B3AF1E687FE158C23011F71E91AE1C1DA8ABDE022DEFEC07B44591946
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 02616868e0e4e800 (8 x Formbook, 7 x Loki, 4 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/282545/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed wacatac
Link:
https://www.filescan.io/uploads/62b401db1fcdba4e1a4c78fe/reports/99dda51c-1caf-445a-8319-6c16563f5c1d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e23c013d-e831-4862-8d98-e849c66ae6e5
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1018435
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-06-23 06:02:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykvg6hair5mjrgcjosmql7lzl2337eqnmsbpzne36or2hugxzdfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1581d502deb070038122c5bf4cb1aca1c7752ad980b3114b0e2321f6f5863616
AgentTesla
3982f95e9287b4848e04b2ae0e9b329720842a5cb221dff83f1ed48e2f7ad6fe
AgentTesla
3a9769350e2cf068de0d41905ed6f101bca6fce1cf4b29a691dc9552f921fb20
AgentTesla
61f96ea28d2752ba6b692f4320b65103ce85c90553b674bb2857142ff52e060a
AgentTesla
94a4a84045dbbc2e2360651f8d0155f6034102605fbf12d797e26fc580a9aa4a
AgentTesla
c95b25f8ee7c2ccdc331d63a9239b4c48b06435b6a1e9dcdecf52909313639b2
AgentTesla
eee6adbe2376d92010a17285408021e90ed1612c640ee069c4e633612236ad65
AgentTesla
f26f175b6191179d1652a4be425c02968ed105891604aae297b2efc14a88c5f5
AgentTesla
f82d2db25d479699bd338ae79010aeabc6b0db9d08a41b44ca47e52730e425e6
AgentTesla
+ 18'702 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220623-grf8gsefh5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
aeb794603358b6c09bde06df5010f2392b6a15c846f4c420fd46bd76cd97655c
MD5 hash:
84b10e20b2b06a1883cf82811d053b90
SHA1 hash:
b1634e9076440ffff8e03231027fcfdbfc31e8e3
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
SH256 hash:
8e377085ab17415da9d2e1c34bdbeeb9d047639ed8e1965edceb7e9567ad2919
MD5 hash:
c5b1bdca222319cbf0d411b5e03df3c9
SHA1 hash:
a48d59e5be0d823f433b6e8fb43151e909d50785
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
SH256 hash:
dfb624b29629f020c329530effc204485cdf0a2f89232cd24168d8ab53004cf1
MD5 hash:
cd5efdd62702391925d6188142229448
SHA1 hash:
929cb1cb9e6a82e93ade0b26a3ceafb25b0b2de8
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
SH256 hash:
87577e6c69af07ba0e6383a2a152b59a39d6b336631ce4baa250bd9f8adce03d
MD5 hash:
9b17d560e68eff0da30f79b3c391c9a3
SHA1 hash:
5ceda263b1ea13401f652c709dd884d58945fe57
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
SH256 hash:
4c2a7f76d8fc5cfe9f205337b2738db0acb94bed8bd05a1bc5d4e93024381511
MD5 hash:
319753a2f6886de0021a5c6317ddf728
SHA1 hash:
3f461f1af4cb72c38295c7f5ae5c2a85bc279cd3
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
SH256 hash:
c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca
MD5 hash:
60c40f266129407afdf825322b69dcb3
SHA1 hash:
c923567554d5160ce1b2528300a06a84943e2dbe
Link:
https://www.unpac.me/results/ceee6b4f-660a-44c4-833f-bc4c778c9736/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c2aa6f1c088f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c2aa6f1c088f58989849749905fd795eb7bf920d6482fcb49bf3a3a3d0d7c8ca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2247152/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/282545/

Comments