MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff
SHA3-384 hash: be9d55a6e99fc1339e73df0d69a5b9a1d16186c4ba986bc6b09c1808d00026ed9f0f70b98175710ecde364eb73d720c9
SHA1 hash: 6c970b75d644199ba87864ee236b904d5e4e26e6
MD5 hash: c2e3a0ce1b9396ab429275de2c797ac3
humanhash: aspen-moon-pluto-eleven
File name:DEBIT NOTE.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:857'600 bytes
First seen:2021-02-24 08:36:21 UTC
Last seen:2021-02-26 17:43:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:1uNOeRwEQWNagJQ3Krcrlhiz6021uysomL95K0/YAn03vSt0BgCDtfa:wNOeRwNKrcBgp2Iy1uK0/YA0f71DF
Threatray 2'879 similar samples on MalwareBazaar
TLSH FD05BF39B390BF96D0196F3AC8132B0693E4C1A37636F2AF2CD418E11615B15CBDE65E
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
10
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DEBIT NOTE.exe
Verdict:
Malicious activity
Analysis date:
2021-02-24 08:38:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/51dd924a-e6ae-4808-a992-54940821685e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118926/
Detection(s):
SecuriteInfo.com.Win32.14593.29635.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Launching a process
Sending a UDP request
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/616395
Signature
Creates multiple autostart registry keys
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 357204 Sample: DEBIT NOTE.exe Startdate: 24/02/2021 Architecture: WINDOWS Score: 96 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected AgentTesla 2->39 41 Yara detected AntiVM_3 2->41 43 Machine Learning detection for sample 2->43 7 DEBIT NOTE.exe 15 7 2->7         started        process3 dnsIp4 35 192.168.2.1 unknown unknown 7->35 27 C:\Users\user\AppData\Roaming\rex.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\...\InstallUtil.exe, PE32 7->29 dropped 31 C:\Users\user\...\rex.exe:Zone.Identifier, ASCII 7->31 dropped 33 C:\Users\user\AppData\...\DEBIT NOTE.exe.log, ASCII 7->33 dropped 53 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->53 12 rex.exe 14 3 7->12         started        15 cmd.exe 1 7->15         started        file5 signatures6 process7 signatures8 55 Machine Learning detection for dropped file 12->55 57 Writes to foreign memory regions 12->57 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->59 61 Injects a PE file into a foreign processes 12->61 17 InstallUtil.exe 2 4 12->17         started        21 reg.exe 1 1 15->21         started        23 conhost.exe 15->23         started        process9 file10 25 C:\Users\user\AppData\Roaming\...\zUbDt.exe, PE32 17->25 dropped 45 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 17->47 49 Creates multiple autostart registry keys 17->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->51 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 08:37:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
56
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hhn5p3wjagerml2wzimcashhkaoy2uvexxqvyxye7xvm74rjl7q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e3772fb826af045d4d6aa5943be1c66bfca44858adaee941606ebce680373d1
AgentTesla
31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57
AgentTesla
52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb
AgentTesla
639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392
AgentTesla
74d935398b83fb7e73bef7bd8127a4421bbfe3b41eee9dd914b546132ce742c2
AgentTesla
8a249dd65a90624d877633b7f9baf3db4bee9ad8dd5a344e9ee59ca799bec8a7
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93
AgentTesla
e3154d853187b18659c637d16cb0a1fdd48c1bfa53c5d39aa11e1ed3db471dbd
AgentTesla
e7ccbe9dfaa198263b85336d9f89a775f7601070708ce65b9e4612332e0207b8
AgentTesla
+ 2'869 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210224-b3778sj44s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff
MD5 hash:
c2e3a0ce1b9396ab429275de2c797ac3
SHA1 hash:
6c970b75d644199ba87864ee236b904d5e4e26e6
Link:
https://www.unpac.me/results/804cccd0-33f1-41c7-b765-b1f8c38d91af/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f41608e9a021a8454a4a59a70b792aec80b6f755218f46c0233a74ddcd49350d

AgentTesla

Executable exe d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 f41608e9a021a8454a4a59a70b792aec80b6f755218f46c0233a74ddcd49350d
Cape
Cape
https://www.capesandbox.com/analysis/118926/
  
Dropped by
SHA256 dfc2118ee872b86cbddf9d318f08054fdc44bc7c32b729687882c3300b2de617
  
Dropped by
SHA256 df6f11961af80eadcd32823820f4c6a50ba488e7c0e23ca39233db37df16ee50
  
Dropped by
SHA256 4d873a495ae2a85f99f68381c210317132cc1026561afb0772368eb376fa3af0

Comments