MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 6 File information Comments 1

SHA256 hash:	ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4
SHA3-384 hash:	621d496a8fbee7d34ad4b9009096eaf4f917e4366083660d649a7c483580d97dd57105f25ff5c34f25ce3929d57c2752
SHA1 hash:	5f4fb1c18bc0a0d86bd34d4d1ebf7d9a8029671a
MD5 hash:	df4f4d8f3a20196e3cbeddfad102cfa5
humanhash:	venus-burger-quebec-zulu
File name:	df4f4d8f3a20196e3cbeddfad102cfa5
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	306'319 bytes
First seen:	2023-06-15 08:24:07 UTC
Last seen:	2023-06-15 08:39:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	61259b55b8912888e90f516ca08dc514 (1'059 x Formbook, 741 x AgentTesla, 427 x GuLoader)
ssdeep	6144:OYa64XACWHjqgLpPR9aalvzGZeo+PnSPM0Uu6bQ3lmGHb4NVPi6:OYSXxW995ZWe/PnSPpp1TMjPp
Threatray	4'422 similar samples on MalwareBazaar
TLSH	T1CD5412054D50C467ECA68F73987A2F1309B7AF167878A74B1BA432793F332D2E11DA16
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	d6c3c1f98c8edef2 (12 x AgentTesla, 5 x SnakeKeylogger, 1 x RemcosRAT)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

283

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

PI.xls

Verdict:

Malicious activity

Analysis date:

2023-06-15 07:30:51 UTC

Tags:

opendir exploit cve-2017-11882 loader

Link:

https://app.any.run/tasks/1f7e0e4e-a362-40a1-a9bc-25929aaa18fa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XorStringsNET

Link:

https://www.capesandbox.com/analysis/399082/

Detection(s):

SecuriteInfo.com.Gen.Variant.Nemesis.23568.12861.10555.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a window

Creating a file

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Сreating synchronization primitives

DNS request

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/90835/overview

Behaviour

MalwareBazaar

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/648acae075931fcf7f14ca20/reports/b4dbd82f-12e8-4ee3-9b20-2d19810a98a3/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/101c9250-7441-47d5-bd1b-08ef87336f47

Result

Threat name:

AgentTesla, NSISDropper

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1255153

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected NSISDropper

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-06-14 15:12:53 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjrymhjeh7scni2625tli5kxyysj7gunxkhodtdtp2w6leckutca._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2eb12d18200b79353510751ef2f4fa4ef70ec48beeaab08bc16d75bacdb90463

AgentTesla

31fae40dd922e63fd26099fa13a7b790c23e529439ea701a15b5c1c168da23f4

AgentTesla

44e5d64cb7530cb3bf9c086a5f1cb7aa7c8a0cd61f08a316b08a95e9d629d853

AgentTesla

84ccefabf526a27d7d711f91219ba6531857883cc103dcfe1823f7d8240eb760

AgentTesla

a6732c43b74439cbbb8fff0defb66d8f81ce10e8c50a940e5f5819c1722bbeca

AgentTesla

b61eefa8b1751ea5698f8b0fbed1e062a824815cf0a14776e9e0113b704236ec

AgentTesla

bd609ee07cbb567275cc8a8b7a1c1e3c14f61f778f18b90b6454ad68c64cfdd7

AgentTesla

f9454d0787965826c1f6e031eb78495f153453fca4efea4ed993dceb61f2e3d8

AgentTesla

+ 4'412 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/230615-kbabsafb99/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

b61eefa8b1751ea5698f8b0fbed1e062a824815cf0a14776e9e0113b704236ec

MD5 hash:

1265ba87324fc8dbad67386fa965e739

SHA1 hash:

9c9f6a5d59c68d6debede6d0e08ebd60cae2609a

Detections:

AgentTeslaXorStringsNet

Link:

https://www.unpac.me/results/2a028482-bc63-4dd6-8cb5-c7004ba97466/

Parent samples :

bd609ee07cbb567275cc8a8b7a1c1e3c14f61f778f18b90b6454ad68c64cfdd7
2eb12d18200b79353510751ef2f4fa4ef70ec48beeaab08bc16d75bacdb90463
a6732c43b74439cbbb8fff0defb66d8f81ce10e8c50a940e5f5819c1722bbeca
84ccefabf526a27d7d711f91219ba6531857883cc103dcfe1823f7d8240eb760
44e5d64cb7530cb3bf9c086a5f1cb7aa7c8a0cd61f08a316b08a95e9d629d853
31fae40dd922e63fd26099fa13a7b790c23e529439ea701a15b5c1c168da23f4
b61eefa8b1751ea5698f8b0fbed1e062a824815cf0a14776e9e0113b704236ec
ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4

SH256 hash:

8ccf4c5f1e3f8dadba1376cc23e1bee1675b59c559f709f935c26d4967fa26ff

MD5 hash:

9cdfa44380c93bbf0dbaee409751fa2f

SHA1 hash:

765a4d2323c77b0eb3c7b8e4b46b283f379896a2

Link:

https://www.unpac.me/results/2a028482-bc63-4dd6-8cb5-c7004ba97466/

SH256 hash:

de9e9eb48c14410b53a031a2f470cc34e505eb9096ab0a5cf44282c81c0b7270

MD5 hash:

6bd1cd5a4b6567126f470bb5e8e30fa6

SHA1 hash:

1ee4b9de601e41e0b8e9d1fbc6a4c9ccbdc8b63f

Link:

https://www.unpac.me/results/2a028482-bc63-4dd6-8cb5-c7004ba97466/

SH256 hash:

ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4

MD5 hash:

df4f4d8f3a20196e3cbeddfad102cfa5

SHA1 hash:

5f4fb1c18bc0a0d86bd34d4d1ebf7d9a8029671a

Link:

https://www.unpac.me/results/2a028482-bc63-4dd6-8cb5-c7004ba97466/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/ca63861d243f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	MSIL_SUSP_OBFUSC_XorStringsNet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it
Reference:	https://github.com/dr4k0nia/yara-rules

Rule name:	msil_susp_obf_xorstringsnet Create hunting rule
Author:	dr4k0nia
Description:	Detects XorStringsNET string encryption, and other obfuscators derived from it

Rule name:	pe_imphash Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe ca63861d243fe426a35ed766b47557c6249f9a8dba8ee1cc737eade5904aa4c4

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/399082/

URLhaus

https://urlhaus.abuse.ch/url/2661646/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-06-15 08:24:08 UTC

url : hxxp://192.3.193.194/34/cleanmgrse.exe