MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93
SHA3-384 hash: 317309fb8dc93534e4b7643e1efa23bbf69cc3ef30fce251bdfbfeeba5c3ca4909a241b56575ad8bb06cf18b6be6f620
SHA1 hash: 7b23c7209b8f37bb32803971c36ab706b4a8e34d
MD5 hash: 8bc8526fbaafbac33118ee652ac97da6
humanhash: arizona-oscar-batman-pasta
File name:MPO-003234.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:877'568 bytes
First seen:2021-02-23 08:21:39 UTC
Last seen:2021-02-26 03:59:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:woUUhJQ3Krcrlhiz6021uysHmL95K0/Y7n03vSt0BgVb:wvKrcBgp2IyGuK0/Y70f7
Threatray 2'845 similar samples on MalwareBazaar
TLSH 8C159E69B752AFD6C31D6F3E8813151887F880A3F277F99F2CE058D11905F168E9E892
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118550/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.6867.18362.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Sending a UDP request
Launching a process
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/615029
Signature
.NET source code contains very large array initializations
Creates multiple autostart registry keys
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 356523 Sample: MPO-003234.exe Startdate: 23/02/2021 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected AgentTesla 2->39 41 Yara detected AntiVM_3 2->41 43 2 other signatures 2->43 7 MPO-003234.exe 15 7 2->7         started        process3 file4 27 C:\Users\user\AppData\Roaming\badman.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\...\InstallUtil.exe, PE32 7->29 dropped 31 C:\Users\user\...\badman.exe:Zone.Identifier, ASCII 7->31 dropped 33 C:\Users\user\AppData\...\MPO-003234.exe.log, ASCII 7->33 dropped 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->53 11 badman.exe 14 3 7->11         started        15 cmd.exe 1 7->15         started        signatures5 process6 dnsIp7 35 192.168.2.1 unknown unknown 11->35 55 Multi AV Scanner detection for dropped file 11->55 57 Machine Learning detection for dropped file 11->57 59 Writes to foreign memory regions 11->59 61 2 other signatures 11->61 17 InstallUtil.exe 2 4 11->17         started        21 reg.exe 1 1 15->21         started        23 conhost.exe 15->23         started        signatures8 process9 file10 25 C:\Users\user\AppData\Roaming\...\zUbDt.exe, PE32 17->25 dropped 45 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 17->47 49 Creates multiple autostart registry keys 17->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->51 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 08:13:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
56
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7q7nhbjqtpd6xkhnwz44rnkjwk2qe37b7y3ub6bwdhm6fihlsjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0424179a326437ff06b39a85d4c36d8b0196b366de2f7f00e8d1163c6c5ebad3
AgentTesla
1e3772fb826af045d4d6aa5943be1c66bfca44858adaee941606ebce680373d1
AgentTesla
31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57
AgentTesla
52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb
AgentTesla
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
AgentTesla
639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392
AgentTesla
74d935398b83fb7e73bef7bd8127a4421bbfe3b41eee9dd914b546132ce742c2
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
e3154d853187b18659c637d16cb0a1fdd48c1bfa53c5d39aa11e1ed3db471dbd
AgentTesla
e7ccbe9dfaa198263b85336d9f89a775f7601070708ce65b9e4612332e0207b8
AgentTesla
+ 2'835 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210223-2mq3nhy23j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93
MD5 hash:
8bc8526fbaafbac33118ee652ac97da6
SHA1 hash:
7b23c7209b8f37bb32803971c36ab706b4a8e34d
Link:
https://www.unpac.me/results/736eef17-440e-4cbe-9b93-536ddfc4899a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242

AgentTesla

Executable exe cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 41a7ac6e5d208cb33d7990496d6e305ea76221238e138f36d6712b750c8a8242
Cape
Cape
https://www.capesandbox.com/analysis/118550/
  
Dropped by
SHA256 18ca656615862e1fe11ad717ef0313e388787bd71eefb28bd823305dbbd3cf25
  
Dropped by
SHA256 4de7d8d35fbd813f145a3fb936b276d70bf01174589730b93922c5edfd8bbd18

Comments