MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
SHA3-384 hash: 10b2203a8aec1ab7cd09d7f555762364012b511fa232d107b7252ecf43a330fb132a00c95c048df768d3612b6a75195c
SHA1 hash: f4ee4d87dceccc95ccb71c2c2c86b3f5147ce22a
MD5 hash: e226b713f80fdd12e6adf47ef7d32fe6
humanhash: muppet-comet-steak-mountain
File name:PO 345678.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:670'720 bytes
First seen:2023-07-11 10:03:57 UTC
Last seen:2023-07-11 10:43:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:MXXYb56I7XBxmMXGUupfgD6ptZECbBQWd6x2h0abPh7D6P:Tt7XuMXGUu5RtJaE6xCPTW
Threatray 4'733 similar samples on MalwareBazaar
TLSH T105E402BD5B742C2BD5FD07F8605062B85FB893A5A662E3C90CC8F0FE12A67C64716187
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 4428d4ccd4d03028 (10 x AgentTesla, 3 x SnakeKeylogger, 2 x Formbook)
Reporter cocaman
Tags:AgentTesla exe Shipping

Intelligence

File Origin
# of uploads :
3
# of downloads :
285
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
PO 345678.exe
Verdict:
Malicious activity
Analysis date:
2023-07-11 10:07:11 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/67c68cf1-bf3a-4583-a502-c3edec1743f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/415456/
Detection(s):
SecuriteInfo.com.Heur.17331.1662.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
DNS request
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/64ad2915a15fc7eb4fd0b765/reports/ad7d3401-61e4-4e52-8aed-7e680bed14f7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/750ef61d-9007-4d7e-b6f4-5aee1b13b93a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1270744
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1270744 Sample: PO_345678.exe Startdate: 11/07/2023 Architecture: WINDOWS Score: 100 74 Found malware configuration 2->74 76 Sigma detected: Scheduled temp file as task from temp location 2->76 78 Multi AV Scanner detection for submitted file 2->78 80 5 other signatures 2->80 7 PO_345678.exe 7 2->7         started        11 szBqpRdsKFXPtk.exe 5 2->11         started        13 XnMvtpc.exe 2->13         started        15 XnMvtpc.exe 2->15         started        process3 file4 52 C:\Users\user\AppData\...\szBqpRdsKFXPtk.exe, PE32 7->52 dropped 54 C:\...\szBqpRdsKFXPtk.exe:Zone.Identifier, ASCII 7->54 dropped 56 C:\Users\user\AppData\Local\...\tmp611B.tmp, XML 7->56 dropped 58 C:\Users\user\AppData\...\PO_345678.exe.log, ASCII 7->58 dropped 90 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->90 92 May check the online IP address of the machine 7->92 94 Uses schtasks.exe or at.exe to add and modify task schedules 7->94 96 Adds a directory exclusion to Windows Defender 7->96 17 PO_345678.exe 17 5 7->17         started        22 powershell.exe 20 7->22         started        24 schtasks.exe 1 7->24         started        98 Multi AV Scanner detection for dropped file 11->98 100 Machine Learning detection for dropped file 11->100 26 szBqpRdsKFXPtk.exe 14 4 11->26         started        28 schtasks.exe 1 11->28         started        102 Injects a PE file into a foreign processes 13->102 30 XnMvtpc.exe 13->30         started        32 schtasks.exe 13->32         started        34 XnMvtpc.exe 15->34         started        36 2 other processes 15->36 signatures5 process6 dnsIp7 60 mail.kbakr.com 162.241.27.28, 49704, 49708, 49714 UNIFIEDLAYER-AS-1US United States 17->60 62 api4.ipify.org 173.231.16.76, 443, 49703, 49709 WEBNXUS United States 17->62 64 api.ipify.org 17->64 48 C:\Users\user\AppData\Roaming\...\XnMvtpc.exe, PE32 17->48 dropped 50 C:\Users\user\...\XnMvtpc.exe:Zone.Identifier, ASCII 17->50 dropped 82 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->82 84 Tries to steal Mail credentials (via file / registry access) 17->84 86 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->86 38 conhost.exe 22->38         started        40 conhost.exe 24->40         started        66 64.185.227.156, 443, 49707 WEBNXUS United States 26->66 68 api.ipify.org 26->68 42 conhost.exe 28->42         started        70 api.ipify.org 30->70 44 conhost.exe 32->44         started        72 api.ipify.org 34->72 88 Tries to harvest and steal browser information (history, passwords, etc) 34->88 46 conhost.exe 36->46         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-07-11 10:04:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
17 of 24 (70.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmwl5wwdjau3ixomevzv26p3gmv62meyoqnhzkfhsvg6ltvystwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c834a9e0b395b4544646c67f8a12972256500cbabb5b71a7433548e8b558920
AgentTesla
36cb70021e8a153c22312876626b4143dc1cca60862d667d2af0c95a1fb9e8ac
AgentTesla
545a4e3b7985223b2edb4f9a3a776d0c6cba118ebce4a22de8c0c07c6b67d2cf
AgentTesla
6171f1157e6d3840397d27a5f484f8595770ad153d5969aa96a058114243cfa8
AgentTesla
8ef9185b4a4b8144846219c5ba29562c83184fdde73333bac466c79e7297a070
AgentTesla
beeb040b9ea080d5d326ecfdd0429cd872ce09138c70eb2975433f3f9878adf5
AgentTesla
c906a3041425da5b92aca8c125d3d9295839b5edd1bb17b22fdd80f1f18a1293
AgentTesla
fee59f311b2bd04aed3c5f40d7453366ceda8931de8e9dee2a64ef03823455ac
AgentTesla
+ 4'723 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230711-l3ydcsgb82/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
cc6099241e00bbbf63ea6bbc24835f58e345590e962ba2f36e7e21a32ca4ec21
MD5 hash:
29829b38b80dd6e2ef1d44028b0a6a5f
SHA1 hash:
6d083f38b625f533008cd7832f6dae632c754569
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
MD5 hash:
dd5e08a16c118fae6ee98ca834299147
SHA1 hash:
446a34e15843a4858222bd01dc16495f8214d9d3
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
Parent samples :
8ef9185b4a4b8144846219c5ba29562c83184fdde73333bac466c79e7297a070
cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
cc6099241e00bbbf63ea6bbc24835f58e345590e962ba2f36e7e21a32ca4ec21
MD5 hash:
29829b38b80dd6e2ef1d44028b0a6a5f
SHA1 hash:
6d083f38b625f533008cd7832f6dae632c754569
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
MD5 hash:
dd5e08a16c118fae6ee98ca834299147
SHA1 hash:
446a34e15843a4858222bd01dc16495f8214d9d3
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
Parent samples :
8ef9185b4a4b8144846219c5ba29562c83184fdde73333bac466c79e7297a070
cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
cc6099241e00bbbf63ea6bbc24835f58e345590e962ba2f36e7e21a32ca4ec21
MD5 hash:
29829b38b80dd6e2ef1d44028b0a6a5f
SHA1 hash:
6d083f38b625f533008cd7832f6dae632c754569
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
MD5 hash:
dd5e08a16c118fae6ee98ca834299147
SHA1 hash:
446a34e15843a4858222bd01dc16495f8214d9d3
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
Parent samples :
8ef9185b4a4b8144846219c5ba29562c83184fdde73333bac466c79e7297a070
cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
cc6099241e00bbbf63ea6bbc24835f58e345590e962ba2f36e7e21a32ca4ec21
MD5 hash:
29829b38b80dd6e2ef1d44028b0a6a5f
SHA1 hash:
6d083f38b625f533008cd7832f6dae632c754569
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
MD5 hash:
dd5e08a16c118fae6ee98ca834299147
SHA1 hash:
446a34e15843a4858222bd01dc16495f8214d9d3
Detections:
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
Parent samples :
8ef9185b4a4b8144846219c5ba29562c83184fdde73333bac466c79e7297a070
cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
4dfe22e7fe8228f2c9111088b882a2dea5c4e80ee0b1596f7a3447b22a6cf5a2
SH256 hash:
3e24c77fe108059f14fe61b8400c5fe023dc2b0ec7c4fe23fa9911681086f7a9
MD5 hash:
a5228b97b33467ac41fac5cac2718252
SHA1 hash:
28bb020c8a53b046fc8e8106f2913e62c5941a0d
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
SH256 hash:
cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec
MD5 hash:
e226b713f80fdd12e6adf47ef7d32fe6
SHA1 hash:
f4ee4d87dceccc95ccb71c2c2c86b3f5147ce22a
Link:
https://www.unpac.me/results/d6707105-87d4-425d-b91e-be9525bee550/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb2cbedac348/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip db7a7c2986fc4cc9b8bd994d611b0da0159e61d70dce3973a30a2d78bba16965

AgentTesla

Executable exe cb2cbedac34829b45dcc25735d79fb332bed3098741a7ca8a7954de5ceb894ec

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 db7a7c2986fc4cc9b8bd994d611b0da0159e61d70dce3973a30a2d78bba16965
Cape
Cape
https://www.capesandbox.com/analysis/415456/
  
Dropped by
SHA256 f107e865094e96f6d264589f878d73d294f6a5d9f682d94871260328f0c25c34
  
Dropped by
MD5 67e1c5b409e2c20bf422f1c711ece3b0
  
Dropped by
MD5 7e794f5b4364ccc34d44138a332ed347

Comments