MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3
SHA3-384 hash: 13f52dde2e5241a5eca05f6aa43fd53c127a1aa2dbedd3f9d873acc329b0fd094398eeb08cca9bc79839bdcc1b83025c
SHA1 hash: 3fa246972684bb430f8a0440c88efe1f09741868
MD5 hash: cbe41dafc587105d8d7eb405b6d43877
humanhash: comet-asparagus-beryllium-juliet
File name:New order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:542'208 bytes
First seen:2022-01-13 16:20:02 UTC
Last seen:2022-01-13 18:21:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:8+v/xawE94cdSoXk9ZqG3nbYZJwmePWiIZGpj:8+3/E5dSImZJ3nbgjiIZ
Threatray 13'741 similar samples on MalwareBazaar
TLSH T1CEB4AD5634F38AF8D4FE96F408E7A8439EB2EDA01D40D64C2F1C8C966592FB81A5D731
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New order.exe
Verdict:
Malicious activity
Analysis date:
2022-01-13 16:25:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ce42b136-3db0-4fc6-a583-d32f5e7e8e61

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/219093/
Detection(s):
SecuriteInfo.com.Trojan.Hosts.49341.24146.28776.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61e0513ef2e8ec86fef89e41/reports/037c0ddc-8453-4dbf-a2d9-389ab4b6aa34/overview
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/173ae77f-9fe6-4576-a50e-5f0e12de58bd
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/920261
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 552743 Sample: New order.exe Startdate: 13/01/2022 Architecture: WINDOWS Score: 100 25 Found malware configuration 2->25 27 Multi AV Scanner detection for dropped file 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 14 other signatures 2->31 7 New order.exe 6 2->7         started        process3 file4 19 C:\Users\user\AppData\...scNEjmPbC.exe, PE32 7->19 dropped 21 C:\Users\user\AppData\Local\...\tmpBFD9.tmp, XML 7->21 dropped 23 C:\Users\user\AppData\...23ew order.exe.log, ASCII 7->23 dropped 10 New order.exe 2 7->10         started        13 schtasks.exe 1 7->13         started        15 New order.exe 7->15         started        process5 signatures6 33 Installs a global keyboard hook 10->33 17 conhost.exe 13->17         started        process7
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-13 16:20:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zocyp3rzbptnr445g7k6zaxvdqpvqy74bzyywop5yqxsnsf3ztrq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
4248a8c899ffd31c3b3771124b5aa9ddc5320bf5b4c274990969a663cda33c01
AgentTesla
6b999f2a2ffb29ab8f254b6454f49753fb1155bbb7414b0bde038ab74d5023ba
AgentTesla
8f5c6b77e087af2abe417b53fc62f3cbe7a2e1250e053b93401fa8026aa7f0af
AgentTesla
91a6b9986b0bdab99c2cb9329096ae0290a54dd44091ca76212ee0cd18bfc93f
AgentTesla
e783beaf61c430d61faec9757962fc8a5314e850e587a7e59dea952f8d25bc97
AgentTesla
e7f8dab841bfbab8c503c254af106b7feba6532147b41fdd7443df082db40c21
AgentTesla
eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1
AgentTesla
+ 13'731 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220113-ts4rdsbdd6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5001490800:AAGpJA13CrKCE8BsIgt3Ld89B-WNqNUjLdU/sendDocument
Unpacked files
SH256 hash:
9332fb4dd68380fde39596d94d7c81b663829dc6d227fa060a69cae2c67d17bd
MD5 hash:
c6d1f7b3aab93cc59640e367cbc3d7bf
SHA1 hash:
7789d925af40edd5466ceecd9ef2ee7f25800de0
Link:
https://www.unpac.me/results/92b22c3b-b53f-4b6f-9154-7a08121ea60c/
SH256 hash:
79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696
MD5 hash:
39f524c1ab0eb76dfd79b2852e5e8c39
SHA1 hash:
428018e1701006744e34480b0029982a76d8a57d
Link:
https://www.unpac.me/results/92b22c3b-b53f-4b6f-9154-7a08121ea60c/
SH256 hash:
cbf4eff5be3498fa229db1cce456443c33417390074c116dbc8079bab4176f1b
MD5 hash:
dfc5807d405464faebe1c7c03104493c
SHA1 hash:
30d6734d6559da144c329e9bd334820355b5656b
Link:
https://www.unpac.me/results/92b22c3b-b53f-4b6f-9154-7a08121ea60c/
SH256 hash:
cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3
MD5 hash:
cbe41dafc587105d8d7eb405b6d43877
SHA1 hash:
3fa246972684bb430f8a0440c88efe1f09741868
Link:
https://www.unpac.me/results/92b22c3b-b53f-4b6f-9154-7a08121ea60c/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cb8587ee390b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe cb8587ee390be6d8f39d37d5ec82f51c1f5863fc0e718b39fdc42f26c8bbcce3

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/219093/

Comments