MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52
SHA3-384 hash: dfc454330067d21e35e4b0a76b1afe7a86699257c5f71a843adf9b1e875d4ab7ccfdddb4efceee7c137ff73bad20260c
SHA1 hash: 5b984d02ff6aa2dcc5722fc600e63eb9dc23bee9
MD5 hash: 01c2e43a256fed047b2c4f4c6e6cf00f
humanhash: edward-oscar-nine-william
File name:01c2e43a_by_Libranalysis
Download: download sample
Signature AgentTesla
Create hunting rule
File size:659'968 bytes
First seen:2021-05-04 08:01:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:cCX7VRlglTCkOlu95CaLZ+MX/1GMS2u6Q2qFx0L1Yj+q0+b7aK03NdY:LRUTc+Iat+MX/1puP2WYeaK09d
Threatray 48 similar samples on MalwareBazaar
TLSH CDE4E03123989F65E47FEB799420001187F6F645EB22E75E7EE841CC5862F80D7B2B62
Reporter Libranalysis
Tags:AgentTesla


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PIX-Mobilepay-00200988224.exe
Verdict:
No threats detected
Analysis date:
2021-05-04 06:59:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ac83a811-9fe9-4617-8f09-fccd5c9c543d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/149764/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.688-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/709521
Signature
Creates an undocumented autostart registry key
Drops executable to a common third party application directory
Drops PE files with a suspicious file extension
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52/
Threat name:
ByteCode-MSIL.Trojan.Agentesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 08:02:23 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e
AgentTesla
1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb
AgentTesla
2afdd3aa2feb767d46e6da9b81c1d77dc1592df952980b5ee636a97ecd3f8e62
AgentTesla
33eaead056bc761caee6ebc9de4251e1488aaafc202d04c0d4863ad29f793ad8
AgentTesla
5493074b52dab5b859bb7bf54fdccf45ac005c3f9a2adafc52ac42891ca84793
AgentTesla
94cea10956f43a889c8714c742cb10e57b44919a05c2c4703d3111acc5d6aafc
AgentTesla
badf31d977ae00d0c4886883d2b9722ae7250939bc5d75566d9ffd0dd59fd171
AgentTesla
d0463bdb7762bbf95edd76625d958df8066f95b53d9e548da60c19c7438a05cf
AgentTesla
dbd88e81ffbe0de0f0168ebf9d28ac1f2a15ce717858e6a0c6cad96adedda9fc
AgentTesla
e1614a878888eddb3296e856dc5f4e63a926b9e4c899cf09da12a8f477ace4cf
AgentTesla
+ 38 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/210504-jh3bg5a3jj/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Loads dropped DLL
Modifies system executable filetype association
Unpacked files
SH256 hash:
11cf5a51e593c007ff4f91294cf505ffd5e425e56387c60d81e6479cc284cc3b
MD5 hash:
73cc3f7e7700e6a54cb5f291dffe5aa1
SHA1 hash:
09174f9fa55c9bac0540efb7a8c682878a32d02d
Link:
https://www.unpac.me/results/6c473d19-9d29-4ff5-9f4c-10b45aaafc6a/
SH256 hash:
cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52
MD5 hash:
01c2e43a256fed047b2c4f4c6e6cf00f
SHA1 hash:
5b984d02ff6aa2dcc5722fc600e63eb9dc23bee9
Link:
https://www.unpac.me/results/6c473d19-9d29-4ff5-9f4c-10b45aaafc6a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf06e027c3102bcc58a5306d7d16f6955c1aff1f2aefc43c325e230ebeb5ed52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/149764/

Comments