MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc57132ffe8b469328ec9bd253694f916ed689c8976e9c8abdf7f6484208124f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc57132ffe8b469328ec9bd253694f916ed689c8976e9c8abdf7f6484208124f
SHA3-384 hash: 5ad228c9c5305ba14c9e8f99b78a497fae11ed797d538d967b6942a87c8b72a2ccd20a990fabcecdf6e99fbec8d164dd
SHA1 hash: 43087f59e0a41ebc0267163c9d1b1b0efe4ee534
MD5 hash: 2daf45126fed26c7b3b793d4b6884112
humanhash: april-jersey-black-twenty
File name:DHL_119040 kvittodokument,pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:124'416 bytes
First seen:2021-11-15 10:17:26 UTC
Last seen:2021-11-15 12:00:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:dvyfiwPsT1F/1ReIIOmlZZyZPqXEXCg02l9:Aiwe/ilvoPqXEL
Threatray 12'722 similar samples on MalwareBazaar
TLSH T1A7C37DD33A1CA8C3EEBD8133B45B48D22B3574B94AF5552B3047F76B8C52662160FA2D
File icon (PE):PE icon
dhash icon 3af2d6e6f6f2f0c4 (2 x AgentTesla, 1 x Formbook)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205883/
Detection(s):
SecuriteInfo.com.MSIL.Downloadergen2.24474.6324.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP GET request to an infection source
Creating a file
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Sending a UDP request
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool obfuscated packed
Link:
https://www.filescan.io/uploads/619233dd3edf00a722d5245b/reports/9005872f-d77b-4264-b24e-5289b778c995/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b56f59ab-fc18-4d5c-837b-48e3b1600d0e
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/889315
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc57132ffe8b469328ec9bd253694f916ed689c8976e9c8abdf7f6484208124f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-15 10:18:06 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zrlrgl76rndjgkhmtpjfg2kpsfxnncois5xjzcv5673eqqqicjhq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0871ac78d30aacf52698990e397b52ba8817cd358ed1278f71539d6c25f0a7a6
AgentTesla
1efeb6855f01285105537707a850845cc045baf47f07e3b357e966eb3b4e1f71
AgentTesla
550f5c6965c2a453da34e269695ae9e3e7776414b0c4cc6741d645af38abe280
AgentTesla
5a5e7d1340f7f0df55e3b9bd4e32a550a7ca937e240d9a3a4e7226fdbfd7b6a1
AgentTesla
a5f17f4bfb15b8d739c235665d26edfb38cf54e860848de6fc08067bfe7ce865
AgentTesla
d305689297d694f0f9402450523a468608f35d4f9058cfcaef63230a54d65f59
AgentTesla
e790bdbae45848c16c2575b6d97f3b70ec40cfed889f2725dfa2f228bd81c359
AgentTesla
+ 12'712 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/211115-mbyqgshhb9/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Downloads MZ/PE file
Unpacked files
SH256 hash:
cc57132ffe8b469328ec9bd253694f916ed689c8976e9c8abdf7f6484208124f
MD5 hash:
2daf45126fed26c7b3b793d4b6884112
SHA1 hash:
43087f59e0a41ebc0267163c9d1b1b0efe4ee534
Link:
https://www.unpac.me/results/0a4c6194-b577-4855-94ca-268af30c2172/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cc57132ffe8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe cc57132ffe8b469328ec9bd253694f916ed689c8976e9c8abdf7f6484208124f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/205883/

Comments