MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df
SHA3-384 hash: f40183958030e432d019bb3efbe085409686d85c74a133d4186b1c873c6137024994470e408177d0e2629059bf6a5dc6
SHA1 hash: 5a74b4d1a5ad78579b5ea2904397377981ed08be
MD5 hash: 76dad6833ec1a795d7fd9386b8912f54
humanhash: golf-fillet-pasta-alpha
File name:HSBC_Receipt.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'544 bytes
First seen:2023-09-29 11:21:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:N2QmrP/hOiVs0uAEd2Ilvd5A8/JyXQbEMt:GgiVZRtIhDhyXQ
Threatray 5'715 similar samples on MalwareBazaar
TLSH T1D1C4BF446BADA623C7BB3372B42102599BF4D196A8A1EBCF949C14F21D82709FD4437E
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe HSBC


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.grayspaceads.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
HSBC_Receipt.exe
Verdict:
Malicious activity
Analysis date:
2023-09-29 14:07:52 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/60fe4767-f7e2-4294-86b8-1d253bf5e403

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/451889/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.12698.2871.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Sending an HTTP GET request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6516b35b83a0c6425d0295c3/reports/86c5ebb7-8496-4cc0-aa16-040500b77b1a/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/eadd77f9-8569-41b3-9cfa-3e80f3f57e1c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1316398
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Contains functionality to log keystrokes (.Net Source)
Creates multiple autostart registry keys
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1316398 Sample: HSBC_Receipt.exe Startdate: 29/09/2023 Architecture: WINDOWS Score: 100 51 Multi AV Scanner detection for domain / URL 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for URL or domain 2->55 57 7 other signatures 2->57 6 HSBC_Receipt.exe 1 5 2->6         started        10 Ckdiifz.exe 5 2->10         started        12 sFvqTr.exe 5 2->12         started        14 2 other processes 2->14 process3 file4 35 C:\Users\user\AppData\Roaming\Ckdiifz.exe, PE32 6->35 dropped 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->69 71 May check the online IP address of the machine 6->71 73 Creates multiple autostart registry keys 6->73 75 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 6->75 16 HSBC_Receipt.exe 17 5 6->16         started        77 Multi AV Scanner detection for dropped file 10->77 79 Machine Learning detection for dropped file 10->79 81 Injects a PE file into a foreign processes 10->81 21 Ckdiifz.exe 14 4 10->21         started        23 sFvqTr.exe 12->23         started        25 sFvqTr.exe 12->25         started        27 Ckdiifz.exe 14->27         started        29 sFvqTr.exe 14->29         started        signatures5 process6 dnsIp7 37 api4.ipify.org 173.231.16.77, 443, 49716 WEBNXUS United States 16->37 47 2 other IPs or domains 16->47 31 C:\Users\user\AppData\Roaming\...\sFvqTr.exe, PE32 16->31 dropped 33 C:\Users\user\...\sFvqTr.exe:Zone.Identifier, ASCII 16->33 dropped 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->59 61 Tries to steal Mail credentials (via file / registry access) 16->61 63 Creates multiple autostart registry keys 16->63 39 104.237.62.212, 443, 49721, 49740 WEBNXUS United States 21->39 41 api.ipify.org 21->41 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->65 49 2 other IPs or domains 23->49 43 api.ipify.org 27->43 45 api.ipify.org 29->45 67 Tries to harvest and steal browser information (history, passwords, etc) 29->67 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df/
Threat name:
ByteCode-MSIL.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-09-29 06:57:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
12 of 36 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y2qae2ty2kbxersg2lgv3op2iwnaxuyg4gpfbrwchatgao3ehdpq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
113e16425e010952150f3c1f7ae615602cd4ca30826b0e7518aa058341058a94
AgentTesla
2628313da5e34653481666207066dd34c810d7285cebf4b1ecea700ba8aed211
AgentTesla
445e78195ac6fda213fe26c8263f5362d0f3f61ff4d5f11e9c1293298a1b422f
AgentTesla
59b1624b294226b93b186dc503efd7c48937542eec03b0d32d27034729c2a733
AgentTesla
6a671ca18a4f031900726988ad33a3675fc4c78d13f4138141a641852948c7f8
AgentTesla
984be8706b65a53d26f032b9471751943cbf5e35d8c4baabcac153053949e283
AgentTesla
c5de366fb77c67ffc4f8daa348f10e4dbd9e68287427943c25a7112b467b89eb
AgentTesla
d85278c4099b913c69779c4b69a0c85cbb0d7cbe72ae9a324b798a0fd2e02fb7
AgentTesla
eb47fa04d84b315142efd50e7bbee163d5cf49de82c961022f4199847e111d78
AgentTesla
+ 5'705 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware stealer
Link:
https://tria.ge/reports/230929-ngklgshh6s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
55a08fa666ead1d83a883b152ce2fe2f7b1824e51a1a0d1c1803b6b359ec509d
MD5 hash:
f3fba060e981b2e4c8d9565ecf99d700
SHA1 hash:
f5a4f919543deb8fee3b188bec7ae0c3eb700423
Link:
https://www.unpac.me/results/5fa064ed-060e-4467-8bc3-11dfa964feb1/
SH256 hash:
8602e7bc7bf2f049fa8a78c68f3404f1f4762586660627c77cc2d6527c187253
MD5 hash:
fa6dcb2926c054e6ca9275bf9c5b3145
SHA1 hash:
875dd644c62014b4656955d1419119568e06e239
Link:
https://www.unpac.me/results/5fa064ed-060e-4467-8bc3-11dfa964feb1/
SH256 hash:
af7f7812ce71650396f33e43f84643d510ff650603fd3f85f7ebeb29c3d42ac0
MD5 hash:
827a9640a0ae3078739ff007187214f9
SHA1 hash:
754b65ab3e2620d23a7170119ab27937925384e0
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
Link:
https://www.unpac.me/results/5fa064ed-060e-4467-8bc3-11dfa964feb1/
Parent samples :
c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df
59b1624b294226b93b186dc503efd7c48937542eec03b0d32d27034729c2a733
SH256 hash:
3f5ef90c3f54558a46b4005dfbabbef3d36ba6ebd6f8d85354d24d69bdadafcb
MD5 hash:
333ed39112e6aeeb7eb8a8bfc711c61e
SHA1 hash:
5fdc3ca976175ce5c26c6fb45a6f887210227995
Link:
https://www.unpac.me/results/5fa064ed-060e-4467-8bc3-11dfa964feb1/
SH256 hash:
c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df
MD5 hash:
76dad6833ec1a795d7fd9386b8912f54
SHA1 hash:
5a74b4d1a5ad78579b5ea2904397377981ed08be
Link:
https://www.unpac.me/results/5fa064ed-060e-4467-8bc3-11dfa964feb1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c6a0026a78d2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c6a0026a78d283724646d2cd5db9fa459a0bd306e19e50c6c23826603b6438df

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/451889/

Comments