MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
SHA3-384 hash: 5df04efbecfaec68308bc0c5dc21522ce3c17477adf41e731fe9c35d6364aa65790c21d45f47248d9e9da848ebdd25af
SHA1 hash: acb4a0b1304b532c3602a58a022b6195d7be4fae
MD5 hash: 31b54d8b3a96f7346c0d96f79a5f70d2
humanhash: fillet-twelve-eighteen-romeo
File name:31b54d8b3a96f7346c0d96f79a5f70d2
Download: download sample
Signature AgentTesla
Create hunting rule
File size:900'096 bytes
First seen:2023-05-10 04:15:23 UTC
Last seen:2023-05-13 22:42:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:sa+10xuaSeL1mlZG9+QMbX+sRgj790019lMq:sr0HL1049Gbdga0ft
Threatray 1'192 similar samples on MalwareBazaar
TLSH T124159E68B361A58EC407CD73495CFC7056217CAB7BC6C11261D33F9BBB6E9869E001A7
TrID 60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 04e425252525e404 (3 x AgentTesla)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
256
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
31b54d8b3a96f7346c0d96f79a5f70d2
Verdict:
Malicious activity
Analysis date:
2023-05-10 04:17:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7d38acc6-c4e8-4c84-869b-c26113368669

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/388000/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys packed
Link:
https://www.filescan.io/uploads/645b1a82d054a0b0ef846e5f/reports/4f39e1fe-008f-4ccf-8e84-106d618ad810/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4c35804-b9d3-4647-b5d0-fcc01a109ecd
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1229718
Signature
Adds a directory exclusion to Windows Defender
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 862699 Sample: 7HWlHhb2Ir.exe Startdate: 10/05/2023 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 3 other signatures 2->59 7 7HWlHhb2Ir.exe 7 2->7         started        11 yBjeTclr.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\Roaming\yBjeTclr.exe, PE32 7->35 dropped 37 C:\Users\...\yBjeTclr.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp6787.tmp, XML 7->39 dropped 41 C:\Users\user\AppData\...\7HWlHhb2Ir.exe.log, ASCII 7->41 dropped 61 Detected unpacking (changes PE section rights) 7->61 63 Detected unpacking (overwrites its own PE header) 7->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 7->65 73 2 other signatures 7->73 13 RegSvcs.exe 15 2 7->13         started        17 powershell.exe 21 7->17         started        19 powershell.exe 21 7->19         started        21 schtasks.exe 1 7->21         started        67 Multi AV Scanner detection for dropped file 11->67 69 Machine Learning detection for dropped file 11->69 71 Writes to foreign memory regions 11->71 23 RegSvcs.exe 11->23         started        25 schtasks.exe 11->25         started        signatures5 process6 dnsIp7 43 mail.sorincrop.com 162.241.27.28, 49698, 49703, 587 UNIFIEDLAYER-AS-1US United States 13->43 45 api4.ipify.org 64.185.227.155, 443, 49697 WEBNXUS United States 13->45 51 2 other IPs or domains 13->51 75 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->75 77 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->77 79 May check the online IP address of the machine 13->79 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        47 104.237.62.211, 443, 49701 WEBNXUS United States 23->47 49 api.ipify.org 23->49 81 Tries to steal Mail credentials (via file / registry access) 23->81 83 Tries to harvest and steal browser information (history, passwords, etc) 23->83 33 conhost.exe 25->33         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-05-03 09:22:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
26 of 37 (70.27%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zm4wji5wulxixuv5xq5dwzjqmvdm5twc322ejfuo5dztzywbuwjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
251ca0215e976403d529fba60bd67ca614a3e6b18a7f2420c64acbf31400ed7c
AgentTesla
4e2f902a6157d7799507b7f68c908c9a2527faba55d4a8b5491906b8b27742c0
AgentTesla
6118fb1f75058c3bd77040399fad44126181a9b131396a4f1ab7e6622c826dda
AgentTesla
6c9edf76efc88d3ae9ba10f36ac4e5b30ad4b5766a41729bba53f78fba84c0bc
AgentTesla
e94f95707bc1ee3c1516cce43846a594acf5a1024ae7a76cb34afe5639fe95b5
AgentTesla
+ 1'182 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230510-evsdtagb5w/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
AgentTesla
Unpacked files
SH256 hash:
21f0154b51a09767f94922b81f5fcd15cf4a6390ab7314e40d0e17b2dcdfe6ba
MD5 hash:
c926563698de3a89ad20474c85122f73
SHA1 hash:
ed1a3b2527ace111e6f39880c7ee3965f301330d
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
SH256 hash:
ed34cde47eee46008225104d876362296aacd15d5ee67b32edcf3cdc674f5dab
MD5 hash:
62429a54d9edb21f051eea40858492b8
SHA1 hash:
c772b149ca70d9fd684630e6a777f76906b10f0a
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
SH256 hash:
abb6749d7d21cd930e86f88fdc55a23d8149b094819e0be6803c8e4c5b8550f3
MD5 hash:
64e0a603c0f22c3e07d8db5e3ebbd80f
SHA1 hash:
b83c1fc823a6e9a31ac5418f6c93f8e0e26a8249
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
SH256 hash:
f5f0576064260ca8994961e9bac29e51ad52cc7473d52f1379d5c533a40beae3
MD5 hash:
b2ed9276e6686711ed5ec6a3a1342147
SHA1 hash:
533064433d0a15f8a28f79bbe8b8ea5b5ad37ffd
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
Parent samples :
cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
2be71dbd5717aadd41efe306affff9fb63675adb1dd4f1a5a7b5d123c4ba508b
c45219a3fd0cf51360c30b7aa0cba985ad1d28030785ab9dc5083090540409d8
3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a
a9adeec302ab071989a321a13b0c9b1f12e4c0fd69f3dab0a99e46d165a40cd3
2406e6d5ca634a5b588ee4bd967cc1ac4ace9e24ac4761471c992f4a1450469f
7cae209399f08c5a85de444babd258aadb253b625356dcd47e4ccf4fca8a013e
db4298e6b1ab62b76c39dbedd3bedcef513acf96a75cc97eabf9f82741027ea5
SH256 hash:
6c6e0ce0e0dff383d161884c8283064d57f8ca47b7451561ba5b12bc9c5942ea
MD5 hash:
a7ed72ad417a0e5a2771ed1c452e91ba
SHA1 hash:
26370bf067b57855a9665a01dca4f68914d3e1fd
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
SH256 hash:
cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593
MD5 hash:
31b54d8b3a96f7346c0d96f79a5f70d2
SHA1 hash:
acb4a0b1304b532c3602a58a022b6195d7be4fae
Link:
https://www.unpac.me/results/8dc23d6d-7188-40f9-804c-f4e28d5fabe2/
Malware family:
AgentTesla.v4
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cb3964a3b6a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe cb3964a3b6a2ee8bd2bdbc3a3b65306546cecec2deb444968ee8f33ce2c1a593

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2628088/
Cape
Cape
https://www.capesandbox.com/analysis/388000/

Comments


Avatar
zbet commented on 2023-05-10 04:15:30 UTC

url : hxxp://192.3.202.72/54/vbc.exe