MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4644f2a1dbfb727b93ed962f0f16c40da6710795e4108e098de2e7f0eaad6f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	c4644f2a1dbfb727b93ed962f0f16c40da6710795e4108e098de2e7f0eaad6f8
SHA3-384 hash:	091b2426be016feaf64713eee7b1b90a715cde2dc80807fbc1e695b76ae4bba5c93a4e0993f7840e4d2baeb80abad4d6
SHA1 hash:	bafb743cc7b6591e9ab9503b42869891c5560e8e
MD5 hash:	52e01a807e767f92000d9a0162d1b97a
humanhash:	winter-bakerloo-cat-nitrogen
File name:	ORDER-P.O IM72E91AL.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'290'240 bytes
First seen:	2020-11-06 17:41:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep	24576:eAHnh+eWsN3skA4RV1Hom2KXMmHazjRYqn5mIWD4PpOzFdr/TSOMV5:Jh+ZkldoPK8YazSU5W+pOzF9LSOu
Threatray	874 similar samples on MalwareBazaar
TLSH	1155AE03739D822DFFAA91736B35B22156BC6E270123852F32D8BD7DA970175122D6E3
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing unidentified malware:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: Shūzhēn Zhéwěi <info@sunmatch.com>
Subject: ORDER-P.O IM72E91AL
Attachment: ORDER-P.O IM72E91AL.exe (contains "ORDER-P.O IM72E91AL.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.AutoIT-3.UNOFFICIAL

SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Launching a process

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/523562

Signature

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c4644f2a1dbfb727b93ed962f0f16c40da6710795e4108e098de2e7f0eaad6f8/

Threat name:

Win32.Trojan.Predator

Status:

Malicious

First seen:

2020-11-06 02:03:54 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yrse6kq5x63spoj63frpb4lmidngoedzlzaqryey3yxh6dvk234a._file

Verdict:

unknown

AgentTesla

3e1c4c5c7e1f5d808225263b7100d3a03849944f57f09cc73634babd03073f3a

AgentTesla

48b1f899e7ad8d880a6bf9d97ada6507c4403c8d8e81815f83fb8181ca247008

AgentTesla

5dc99cdcbe826905fda928debc00fd44e0d447e1b797e74c11a8bd77133dd770

AgentTesla

6d1cfff093998c807b9c5dc3fd122adbea40c5bad0cad4cbe10b43932c28bdd9

AgentTesla

89f1ed8a332907a1e20a452f773576cc53bc7bfcb2aeb20eb4501d57a5574d2e

AgentTesla

90e558ae189e039ebfb1fa64a6a6e917fbb98be91fc125dbe7b32ba305398158

AgentTesla

b052d189fbba69117efc6e10e1cada3faee844cb59b5f0d1482734976c72bd58

AgentTesla

db6c57acf61c5e3fc79190feca4683089f6a05b8af985e49361d25995178e4d0

AgentTesla

e897888dd36ab2a5740030d628f510ef0563d9d039e896b45134a4a5c4a82bb7

AgentTesla

+ 864 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/201106-spw25c7kjn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

c4644f2a1dbfb727b93ed962f0f16c40da6710795e4108e098de2e7f0eaad6f8

MD5 hash:

52e01a807e767f92000d9a0162d1b97a

SHA1 hash:

bafb743cc7b6591e9ab9503b42869891c5560e8e

Link:

https://www.unpac.me/results/59d6a828-2ac6-4908-8ab6-9d6d013cbf50/

SH256 hash:

76ebfad4833463a44ca2ec78b980e07fd1557ac43ecd0ba26d31a8bd2c4c09d6

MD5 hash:

1605119d7b0aa7bbefb2f1488e0ebd8f

SHA1 hash:

6bac0a84550aa81a21e6181ec44db4b267d1675c

Link:

https://www.unpac.me/results/59d6a828-2ac6-4908-8ab6-9d6d013cbf50/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.