MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21
SHA3-384 hash: af9cdcd074eae02429b761711e21126d49ceea4746db41d388ea21b2309876ba64250f373b065fd73b7787fc80eeb7a7
SHA1 hash: beffae358f9b2bcca9d969261c99aa2f7e553a91
MD5 hash: c3ec4a8aa7918704724356d0a46bf4e4
humanhash: chicken-october-rugby-orange
File name:PO.2200041757.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:766'976 bytes
First seen:2021-02-14 12:54:52 UTC
Last seen:2021-02-14 14:55:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:ZDI9QaV4j0frPvO1ig4jBqA+50kC/Gpbls90EJyFVSlQoseFmD0DpG3IS:Zk9XzPqCqANkUB9hYVqseFvA3
Threatray 2'605 similar samples on MalwareBazaar
TLSH 8FF4E03032986F5DE93E937E4122461093F2A52BE331D61ABDEC11EB1A95F418332F57
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sealcode.com
Sending IP: 103.151.122.27
From: codink@sealcode.com
Subject: New Purchase Order 2200041757
Attachment: PO.2200041757.zip (contains "PO.2200041757.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO.2200041757.exe
Verdict:
Suspicious activity
Analysis date:
2021-02-14 12:58:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bf1ace12-0fb5-46c0-8de5-229dca478a47

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117071/
Detection(s):
SecuriteInfo.com.ArtemisC3EC4A8AA791.6803.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/607565
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 352811 Sample: PO.2200041757.exe Startdate: 14/02/2021 Architecture: WINDOWS Score: 92 19 cdn.onenote.net 2->19 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected AgentTesla 2->27 29 5 other signatures 2->29 8 PO.2200041757.exe 3 2->8         started        signatures3 process4 file5 17 C:\Users\user\...\PO.2200041757.exe.log, ASCII 8->17 dropped 31 Injects a PE file into a foreign processes 8->31 12 PO.2200041757.exe 2 8->12         started        signatures6 process7 process8 14 dw20.exe 22 6 12->14         started        dnsIp9 21 192.168.2.1 unknown unknown 14->21
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-14 12:18:15 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ogtymxonf4idgf2vi5z5y5s3v6cugfobefwym3mb7mj23dtxuqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
491139cde010544822237cf87d9a34ace22a8e2bfd4eb7cc5ebd060e465e63f7
AgentTesla
756872f4d16293b9ecef4d7ac6a632bcd120e5afff1acd42750cca5875794493
AgentTesla
931b74dae99d57d93b21fb72c0da9184b83e04f95e024e9a7990a6c57a73ac7e
AgentTesla
9898c37e93d4e9a054c013f34ca57c1aa9130112c9104386219f94e1125d0b97
AgentTesla
b637168bfa7520b4317e7c0b3f671c339a54b8cc37e5f7348aee8a40fa32239a
AgentTesla
d2900e5f43d302add8c33e39ac9949ea94e3b927a3d56611b60b8e81f4768fbd
AgentTesla
e87ed8ad9f753e4de9899be1bca89baf0655588679245a73c524c737512e0a45
AgentTesla
+ 2'595 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/210214-8c18tmapxx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/7bdf6543-0b4a-4303-82cb-700a841262a6/
SH256 hash:
db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21
MD5 hash:
c3ec4a8aa7918704724356d0a46bf4e4
SHA1 hash:
beffae358f9b2bcca9d969261c99aa2f7e553a91
Link:
https://www.unpac.me/results/7bdf6543-0b4a-4303-82cb-700a841262a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b4f725b056394286a3c95a2dc158c00e7f9dd5472715acfedbb737a1a8deeab4

AgentTesla

Executable exe db8d3c32ee69788198baaa3b9ee3b2dd7c2a18ae090b6c336c0fd89d6c73bd21

(this sample)

  
Dropped by
MD5 f4c07521487e028a63b7dfd3778d5d36
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b4f725b056394286a3c95a2dc158c00e7f9dd5472715acfedbb737a1a8deeab4
Cape
Cape
https://www.capesandbox.com/analysis/117071/

Comments