MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 4 File information Comments 1

SHA256 hash:	cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891
SHA3-384 hash:	8f0a7681c50e8370daa603c912d3e4631197cecc963cf6f13e5ff9287f016b15fe16600d56b719e912c807f53a8f80d2
SHA1 hash:	9f27fdba883f1e1b2b83b335e9d45ccf642778cc
MD5 hash:	be5084e351dfbf93ca2cc522907e4cc6
humanhash:	zulu-victor-arkansas-virginia
File name:	be5084e351dfbf93ca2cc522907e4cc6
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	613'888 bytes
First seen:	2023-10-14 04:47:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:WdJQwYCvompQDjlazJ4ipgBNi6flZs1MQRb9d6AaJUHRvkffg3R:WdJQzCvohnl2aK36dZQ9l9d2JUHRvkAB
Threatray	2'012 similar samples on MalwareBazaar
TLSH	T141D412AB65E70E5BCB850779C1A183470F70A34B1677DB18349426FFEE263C05687AE2
TrID	67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	04c0e0ecc8c4c408 (9 x AgentTesla, 2 x Loki, 2 x Formbook)
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

308

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

be5084e351dfbf93ca2cc522907e4cc6

Verdict:

Suspicious activity

Analysis date:

2023-10-14 04:49:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/43f922e3-55fd-4b74-a17e-a97a5da36bd0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Formbook

Link:

https://www.capesandbox.com/analysis/454268/

Detection(s):

SecuriteInfo.com.Trojan.DownLoaderNET.710.11890.17452.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/652a1d828d16e62970c5a0a8/reports/8e4bd0ac-0138-46d2-9910-fbb2b5220b16/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9f37df9e-be9e-4bf2-b995-d8d418e081ef

Result

Threat name:

FormBook

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1325597

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect virtualization through RDTSC time measurements

Yara detected AntiVM3

Yara detected FormBook

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891

Detection:

formbook

Link:

https://mwdb.cert.pl/sample/cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891/

Threat name:

ByteCode-MSIL.Backdoor.Bladabhindi

Status:

Malicious

First seen:

2023-10-12 06:50:39 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 23 (86.96%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zqddfdcbf72bcjo3z2ylykbyyhf6ujh2fee3oykobc3fi2wxpciq._file

Verdict:

malicious

Label(s):

formbook

agenttesla

AgentTesla

6c8bb939433b05a8b56b08ef68f8c5b5f396bc2b5454ec09d4ee1654951ff463

AgentTesla

795998e9064cb981d6a40a34fbeee48381121ea7ac7175ffe5b506b11cf843d7

AgentTesla

afd193c804de7b5b9e18a0f385233c2706175b30bab03afe82be899e08689b82

AgentTesla

b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65

AgentTesla

bbcaa127862b5b70b5a833b3136f431c03a9165dd0a4646ba78922ebcc7ebdc3

AgentTesla

c1aa65f7c2cc6beb7052c8ada46a3139fc01da66890f4153a7c5761292b71d61

AgentTesla

dc999aa2db84e4f91022be10a55e971c49da82960027b7482b44856fee46f9cc

AgentTesla

f3c99b21d43e967be5b3e53e70050b9d6dce181fe5415f9825b512850ecb0b52

AgentTesla

+ 2'002 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:o6g2 rat spyware stealer trojan

Link:

https://tria.ge/reports/231014-fe4btagc4w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Formbook payload

Formbook

Unpacked files

SH256 hash:

b6b4c1bf2557e39c7f27e701d918cfed75ef7e91ec20db9231d7a9a5b1334c07

MD5 hash:

e5b3ff28403f788b6edd987572b27042

SHA1 hash:

6baeb28f9767310d00c497d1b7abc28662066303

Detections:

FormBook

win_formbook_w0

win_formbook_auto

win_formbook_g0

Link:

https://www.unpac.me/results/94f9b83b-7d61-4f85-8f9e-4c5c579a81de/

Parent samples :

cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891
62903469e69d822aaf737b1dee1aed354de510ede2e25fbcd9fff3a55b24916a
ee15b6d592e19dac7b1baedfd072befcf7351c2e65ca5b2fca9ed1fb61ba3e11
024aa4a117fa7c5952577b1e904510e09c0e048a7bfaf320fcbdb4f309c41ba5
9680fcf70fd9253914ccf18d134c357b91fbce01f3f5161d13d54f0ddd464872
cf1280dea0bfb86e585e302b4dc4fd51cb1f12847b4685cd377f1a6c8f63765b
04073b41e1f33312946b820420b0ec47883fed34fe5b6db261bfd0b99feb0a91
3c5af02b843a0fd2df2f8558917ab584aa45de1ee6ab13612d589fd8c653bbf9
be50ecdddf0589ae6dd2b3d8c089ea1382a5ce29053693f12fea2c551c6b379e
639d5d04a0ea4de3360bd342b8b821ad7f317d4520dd17da071fb24d316d13d0

SH256 hash:

b1270dc9ec3f22c6fd2296239426ac7c48589589580d4a1b3da8188920b22a63

MD5 hash:

5c904da8528cfb1b87b15a6aa7c059cd

SHA1 hash:

f0a192969485d1bc34bf52adf37d9c20176d6b85

Link:

https://www.unpac.me/results/94f9b83b-7d61-4f85-8f9e-4c5c579a81de/

SH256 hash:

ffabc13f7fad5bea21ab9b04b5c04700394db8ec812f01af098dfbd213b0cded

MD5 hash:

bb95d7e54d7271723c25cf89f5bc63fc

SHA1 hash:

c00a879d8c2bf1d1600387eee96b70f53fa53a39

Link:

https://www.unpac.me/results/94f9b83b-7d61-4f85-8f9e-4c5c579a81de/

SH256 hash:

54d7162e22c38c5478ae2be855378a5affb8dcf6c412b2b5de5825b9f7e09c41

MD5 hash:

da52648637269daaa24ea5338cf939dd

SHA1 hash:

3fb9797fdccfd2e4c818bab48b53b7348d07344f

Link:

https://www.unpac.me/results/94f9b83b-7d61-4f85-8f9e-4c5c579a81de/

SH256 hash:

cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891

MD5 hash:

be5084e351dfbf93ca2cc522907e4cc6

SHA1 hash:

9f27fdba883f1e1b2b83b335e9d45ccf642778cc

Link:

https://www.unpac.me/results/94f9b83b-7d61-4f85-8f9e-4c5c579a81de/

Malware family:

FormBook

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc06328c412f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

exe cc06328c412ff41125dbceb0bc2838c1cbea24fa2909b7614e08b6546ad77891

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2720410/

Cape

https://www.capesandbox.com/analysis/454268/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-10-14 04:47:23 UTC

url : hxxp://185.28.39.18:7777/185.28.39.18/pablozx.exe