MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e
SHA3-384 hash: 56dcf2bb64f22b5a6147232abf6e6b0489b84287c84c72d2e260ed4705b33117b117fcfe632ec361da123f7afc9ae743
SHA1 hash: 05b149fee68f29baf0179b88cb1d46fc49767c43
MD5 hash: bc657d009d1f9dfdc3b09281f822eb05
humanhash: missouri-colorado-johnny-arkansas
File name:rDetallesdenuev.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:44'544 bytes
First seen:2024-06-11 17:45:11 UTC
Last seen:2024-06-11 19:56:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:dhJ3MvtAWTAMD/hO74MsXsiC+ojM5kb+9wlTFRiYD:dhJ3IuWTAU5LMsXfEyk6+XRiA
Threatray 1'723 similar samples on MalwareBazaar
TLSH T174133C8B63C59AE2C26E1F7F6AF0731907F4C160AB8BE7A78D4C53F53D0A7990920546
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
338
Origin country :
BR BR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9bcb22d21295f4df633b1cc93c89db3d29b7b93759d5580e9755d6f8fc291d25.uue
Verdict:
Suspicious activity
Analysis date:
2024-06-11 09:10:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/85f0816e-e45e-4c68-ab5c-9dcfcd72d1b4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.DownLoader47.2431.19046.10044.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=666812545c0e232c1ff0451cwin7simulatehigh_evasion
Tags:
Network Agent
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
89%
Tags:
obfuscated packed packed smartassembly smart_assembly
Link:
https://www.filescan.io/uploads/66688d5bef9fdf64aa6a1110/reports/6f2b2d87-a395-4589-acce-4cd8bae96a40/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3cfbfb5-36db-4391-9b4b-d45e7fbdb64d
Result
Threat name:
AgentTesla, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1455407
Signature
.NET source code contains potential unpacker
AI detected suspicious sample
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ipconfig to lookup or modify the Windows network settings
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1455407 Sample: rDetallesdenuev.exe Startdate: 11/06/2024 Architecture: WINDOWS Score: 100 51 mail.100demoras.pt 2->51 53 ip-api.com 2->53 55 3 other IPs or domains 2->55 69 Snort IDS alert for network traffic 2->69 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 13 other signatures 2->75 8 rDetallesdenuev.exe 15 5 2->8         started        13 Nlbdjgdctg.exe 14 3 2->13         started        15 Nlbdjgdctg.exe 2->15         started        signatures3 process4 dnsIp5 57 afanew.cl 138.255.101.194, 49705, 49713, 49717 GRUPOZGHSPACL Chile 8->57 43 C:\Users\user\AppData\...43lbdjgdctg.exe, PE32 8->43 dropped 45 C:\Users\...45lbdjgdctg.exe:Zone.Identifier, ASCII 8->45 dropped 77 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->77 79 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->79 81 Injects a PE file into a foreign processes 8->81 83 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->83 17 rDetallesdenuev.exe 2 8->17         started        21 cmd.exe 1 8->21         started        23 cmd.exe 8->23         started        85 Multi AV Scanner detection for dropped file 13->85 87 Machine Learning detection for dropped file 13->87 25 Nlbdjgdctg.exe 13->25         started        27 cmd.exe 1 13->27         started        29 cmd.exe 13->29         started        file6 signatures7 process8 dnsIp9 47 ip-api.com 208.95.112.1, 49706, 49718, 80 TUT-ASUS United States 17->47 49 100demoras.pt 188.40.116.241, 49707, 49708, 49719 HETZNER-ASDE Germany 17->49 59 Uses ipconfig to lookup or modify the Windows network settings 21->59 31 conhost.exe 21->31         started        33 ipconfig.exe 1 21->33         started        61 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->61 63 Tries to steal Mail credentials (via file / registry access) 25->63 65 Tries to harvest and steal ftp login credentials 25->65 67 Tries to harvest and steal browser information (history, passwords, etc) 25->67 35 conhost.exe 27->35         started        37 ipconfig.exe 27->37         started        39 conhost.exe 29->39         started        41 ipconfig.exe 29->41         started        signatures10 process11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2024-06-10 17:25:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ztbzpqv2y555fhntdaugdkkhxnbcfnpptxepn4tfxpycispf6fpa._file
Verdict:
malicious
Similar samples:
047315e937d8697bccc03e03215f5a43ac3c1cde7c4e18dc9d1e55b14af01293
AgentTesla
5978255ccd6c77df69ec56c2a9777e84e775d5996d935d90e6dd978b94b2e802
AgentTesla
7ecf055419ccb76a13fa53d8f5c5888ea369271ceaad4263f952da6d265c4c41
AgentTesla
8b8d68a47897fc7f8612ad932aec65de7e5523d2ed7619dadb686f1c1adeab80
AgentTesla
90b112bdd91653ba38fbc373ed28c7bf9467f67f64d24f1aca0dd2a4829f245d
AgentTesla
b17bb3acfdbdc750bc117c6e973019d71f6f182b64ed4e680746ac6604158c18
AgentTesla
ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e
AgentTesla
+ 1'713 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/240611-wb98ysvfpc/
Behaviour
Gathers network information
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads WinSCP keys stored on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d0a09f27-03e8-4627-a079-6d6c03c22a03
Unpacked files
SH256 hash:
ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e
MD5 hash:
bc657d009d1f9dfdc3b09281f822eb05
SHA1 hash:
05b149fee68f29baf0179b88cb1d46fc49767c43
Detections:
PureCrypter_Stage1
Create hunting rule
INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Link:
https://www.unpac.me/results/0bf4b7a4-c428-4948-a37e-3fcb4e6232cf/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ccc397c2bac7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ccc397c2bac77bd29db3182861a947bb4222b5ef9dc8f6f265bbf02449e5f15e

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments