MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048
SHA3-384 hash: 06baa1ca9e4df5684b006b8eab775c2b36f5050b1b4bea277a257b0fe121f8f5f80bd8b76bfe7eb56f4111e3ccef2e47
SHA1 hash: d5d82d2f75d8ba9644f32cfdbcbdc74898df466b
MD5 hash: 71456fa133d4467e65a1d039de8142b8
humanhash: may-hydrogen-march-kentucky
File name:CardFinans09000.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'027'152 bytes
First seen:2020-12-28 08:00:54 UTC
Last seen:2020-12-28 09:29:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:ubZHy1OjalZXbz4/kn9GNMwm3KngWg2r27gWqbX1/kdi5VoBdKACwPBbci9814U6:uoH
Threatray 2'009 similar samples on MalwareBazaar
TLSH EF951D02498168CBD7B2D490A38EC2D6B38795DCE7EA6FD4BE10E21531CC467EBB9D41
Reporter abuse_ch
Tags:AgentTesla exe geo TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosted-by.rootlayer.net
Sending IP: 45.137.22.52
From: QNB Finansbank E-Ekstre<ekstre@eekstre.qnbfinansbank.com>
Subject: CardFinans KOBİ Visa Kasım ayi ekstreniz.
Attachment: CardFinans09000.tar (contains "CardFinans09000.exe")

AgentTesla SMTP exfil server:
srvc13.turhost.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
464
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CardFinans09000.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 08:11:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a948f44b-2f97-47ec-b9c9-88d22d09f6a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.ArtemisTrojan.19851.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a file
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/570603
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 334359 Sample: CardFinans09000.exe Startdate: 28/12/2020 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for dropped file 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected AgentTesla 2->44 46 7 other signatures 2->46 6 CardFinans09000.exe 3 5 2->6         started        10 CardFinans09000.exe 2->10         started        12 CardFinans09000.exe 2 2->12         started        14 3 other processes 2->14 process3 file4 28 C:\Users\user\AppData\...\CardFinans09000.exe, PE32 6->28 dropped 30 C:\...\CardFinans09000.exe:Zone.Identifier, ASCII 6->30 dropped 32 C:\Users\user\...\CardFinans09000.exe.log, ASCII 6->32 dropped 56 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->56 58 Creates an undocumented autostart registry key 6->58 60 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->60 62 Drops PE files to the startup folder 6->62 16 CardFinans09000.exe 2 6->16         started        64 Creates autostart registry keys with suspicious names 10->64 66 Creates multiple autostart registry keys 10->66 18 CardFinans09000.exe 10->18         started        68 Injects a PE file into a foreign processes 12->68 22 CardFinans09000.exe 12->22         started        24 CardFinans09000.exe 12->24         started        26 CardFinans09000.exe 14->26         started        signatures5 process6 dnsIp7 34 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.220.115, 443, 49765 AMAZON-AESUS United States 18->34 36 srvc13.turhost.com 37.230.106.17, 49766, 587 AEROTEK-ASTR Turkey 18->36 38 2 other IPs or domains 18->38 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->48 50 Tries to steal Mail credentials (via file access) 18->50 52 Tries to harvest and steal ftp login credentials 18->52 54 Tries to harvest and steal browser information (history, passwords, etc) 18->54 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 06:38:16 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykzrxtazq2bt2gbepxg5pddb223qcwbcn5bppfi7ckklykrxabea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
10791cad73c6725fb874bbce635798638b7b53a6c6653c5ce76c02798fa01ab5
AgentTesla
137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
AgentTesla
4b54cee8f8b2575cee216504872b9849201aea876327300a57d34f089ecdcd57
AgentTesla
6f47301c8691d7f68ccf71931b8e2664fad0720d1f4d01f4bfda35cd1a076bd1
AgentTesla
7c1cc691d4f45e93604996ead834345964e3ccc2e20c0df32376cf70c81fa802
AgentTesla
8fcfe841647c5f4d3f10b59fa63b2e2dff841b4c5c39cbfa828146281e49ad77
AgentTesla
a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49
AgentTesla
c05e310c646407fa733712a98c822a5416ca1124322429d8d2a90966e909a6b5
AgentTesla
c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b
AgentTesla
fd487c8892d4d57d7efa830b72648b2c5234ba09a0dfdced267bf5943a1861a5
AgentTesla
+ 1'999 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201228-bans8qck3e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads user/profile data of web browsers
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048
MD5 hash:
71456fa133d4467e65a1d039de8142b8
SHA1 hash:
d5d82d2f75d8ba9644f32cfdbcbdc74898df466b
Link:
https://www.unpac.me/results/05810157-0ebd-4806-aee7-097dc261edeb/
SH256 hash:
8064220adeef3f6a51e1a26de4082e48575d648c13fb74596e999b788321dd30
MD5 hash:
0833bbf8f40618d69549e10126c0403e
SHA1 hash:
a218b3f898a9d1293506c927026c12a99b062b76
Link:
https://www.unpac.me/results/05810157-0ebd-4806-aee7-097dc261edeb/
SH256 hash:
8e471a6917292a5b83c138818fcca40ca526dce34d7e0bfe4d96d3fa21f62b57
MD5 hash:
1a0350add9d4c3bb239a33dc7f9a9906
SHA1 hash:
ffee469dbe0772d40afb4be5b555597c6cc57d2d
Link:
https://www.unpac.me/results/05810157-0ebd-4806-aee7-097dc261edeb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.09
Link:
https://yomi.yoroi.company/submissions/c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 655890cbf775e8d1c151b7556498122955db7e3655aea0ee09d17747e50bdd0e

AgentTesla

Executable exe c2b31bcc1986833d18247dcdd78c61d6b70158226f42f7951f1294bc2a370048

(this sample)

  
Dropped by
MD5 bedc32f0a0a344e9c718b38fe7301ebb
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 655890cbf775e8d1c151b7556498122955db7e3655aea0ee09d17747e50bdd0e

Comments