MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 15


Intelligence 15 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63
SHA3-384 hash: bdb586376ed2b66ee28f6b71ab3da4dfe54a159051fe3459dbf69dcd53184ee3d8476b6ded0821b85c24468207650705
SHA1 hash: 938b6a4f2eade1880fc847ddbf1366a6c701e3f6
MD5 hash: f8b7da12abb1b1c9273aab76aa0727b5
humanhash: mountain-green-coffee-carbon
File name:BEYKIZI Sipariş 6210 FFFP2 % NR DNo2561 PB 34870.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'480 bytes
First seen:2024-05-30 06:20:13 UTC
Last seen:2024-05-30 07:28:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:j2iKVOkEdJS4V+UpHi/QbuSZ1B7QVvcCbZScBpUgxA05kPD58J8giTPfOUHX:qCkiScHpCN6BsV195735kP18QDf
Threatray 3'198 similar samples on MalwareBazaar
TLSH T1F8F4021873BC8B2AFABFDBF525355A2507BB741BB951E2694CC229C90A31F409C21F53
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 00684d7179696800 (3 x Formbook, 2 x Loki, 2 x AgentTesla)
Reporter abuse_ch
Tags:AgentTesla exe geo TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
334
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63.exe
Verdict:
Malicious activity
Analysis date:
2024-05-30 06:39:49 UTC
Tags:
exfiltration stealer agenttesla smtp
Link:
https://app.any.run/tasks/174b1264-3795-4f20-baf8-e6a1be672517

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Packed2.46849.14794.7099.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66581af8af950bab634f95a3win7simulatehigh_evasion
Tags:
Banker Encryption Execution Gensteal Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a14f6280-ea35-44ec-9fbc-1e28aa59c312
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1449389
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to log keystrokes (.Net Source)
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1449389 Sample: BEYKIZI Sipari#U015f 6210 F... Startdate: 30/05/2024 Architecture: WINDOWS Score: 100 34 mail.saralgumruk.com 2->34 36 15.164.165.52.in-addr.arpa 2->36 50 Snort IDS alert for network traffic 2->50 52 Found malware configuration 2->52 54 Malicious sample detected (through community Yara rule) 2->54 56 12 other signatures 2->56 8 BEYKIZI Sipari#U015f 6210 FFFP2 % NR DNo2561 PB 34870.exe 4 2->8         started        11 ctsdvwT.exe 3 2->11         started        13 ctsdvwT.exe 2 2->13         started        signatures3 process4 signatures5 58 Adds a directory exclusion to Windows Defender 8->58 60 Injects a PE file into a foreign processes 8->60 15 BEYKIZI Sipari#U015f 6210 FFFP2 % NR DNo2561 PB 34870.exe 1 5 8->15         started        20 powershell.exe 21 8->20         started        22 BEYKIZI Sipari#U015f 6210 FFFP2 % NR DNo2561 PB 34870.exe 8->22         started        62 Antivirus detection for dropped file 11->62 64 Multi AV Scanner detection for dropped file 11->64 66 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->66 68 2 other signatures 11->68 24 ctsdvwT.exe 2 11->24         started        26 ctsdvwT.exe 13->26         started        process6 dnsIp7 38 mail.saralgumruk.com 185.81.155.88, 49350, 587 RADORETR Turkey 15->38 30 C:\Users\user\AppData\Roaming\...\ctsdvwT.exe, PE32 15->30 dropped 32 C:\Users\user\...\ctsdvwT.exe:Zone.Identifier, ASCII 15->32 dropped 40 Tries to steal Mail credentials (via file / registry access) 15->40 42 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->42 44 Installs a global keyboard hook 15->44 46 Loading BitLocker PowerShell Module 20->46 28 conhost.exe 20->28         started        48 Tries to harvest and steal browser information (history, passwords, etc) 26->48 file8 signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2024-05-30 05:57:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32laxuary4i4buttzdmhytsptiwd3au7hlkks3c2c5oyzcug5rrq._file
Verdict:
malicious
Label(s):
agenttesla_v4
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
6335b9e2204cdd0a2c6cbd39296aa6b409e46a3ec9ccec992423e65ddae20f30
AgentTesla
75c96c8d4e720fe1290200707fcca94188b4525dcc8ae2f1dfe49068b7bb3e83
AgentTesla
bda83410e36e6df3e02531ed3dbe7d419e8d950e5492d70ef222969013481778
AgentTesla
d38c0d55a08eaf025aa10acc369013f10031a2e09916e208d9c08aaae66f4e78
AgentTesla
+ 3'188 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution
Link:
https://tria.ge/reports/240530-g4b5ashb8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Checks computer location settings
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
1a1de9f3fe4c3a7ea7cd547cdd9d78b3873d6e243e544e5bb647452d6d9f6cfe
MD5 hash:
ceb52a5c98659e8905ea76737fe00c01
SHA1 hash:
bb7b30ff84d6aa26eaa0021c9fa3cd2c5a08e694
Link:
https://www.unpac.me/results/e8b2c9b4-14f5-4efe-a276-aa0babaa6637/
SH256 hash:
25b5214317428b6661d063585c9de0ceb173e0cbf529069873599ac09f179ae9
MD5 hash:
a09ba49a164d02715cea9498b85dadb3
SHA1 hash:
5cb0c737d9fb738c36ca64082b53cd2d816b6e8b
Link:
https://www.unpac.me/results/e8b2c9b4-14f5-4efe-a276-aa0babaa6637/
Parent samples :
6379fc2cce3608db3ed95f85abf8e7391890b839c151224cca1dfc64c545b4d1
655a38b1686aa4f75f6dd4f2b59c8e9e09cde9997b46bafbe4e3dee38d859c99
SH256 hash:
9808caa443f3dc6805e9bc52a7f3f3ee9b566fa1000a282bb50706d06fd6e035
MD5 hash:
87e4b176134c3e0c248b698c125dc504
SHA1 hash:
1fb798c3f90173c50d877b73db26e11397ae5adc
Detections:
AgentTesla
Create hunting rule
win_agent_tesla_g2
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Agenttesla_type2
Create hunting rule
INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
INDICATOR_EXE_Packed_GEN01
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Link:
https://www.unpac.me/results/e8b2c9b4-14f5-4efe-a276-aa0babaa6637/
Parent samples :
333143359814a2f5f5f368af6d19ba412429b6a951c1bf4c2fe68428b40f1bae
9042e8e65eb82000c3929cffd9782aa9b340932f4db19597273695e911551526
3713a53f5b24fd88d75534391e13d6883666805647e7ef4c79f8ab94e9083f4d
9911742dece406745ed3fdaf47f07a346ab5d2ce30c561968dadb7a0534684de
b5e9a3a112c889e9afaa48926ed0bf9474fb430cc99dff8915192877f58d5efe
4cd5de1b258cc0759ac0e866cc65ce615cdd8de99fc35d12d69983aa2c54519f
3f830d043441cc2229addc4c2f5d99606d67f708647e2d570b7080fdd04c8f3b
de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63
SH256 hash:
0322a3a8ff831e22cbbcc3d93ee9f191323bf3419e74422cbb52b97e1380eca2
MD5 hash:
0e5e2c81b9ebd0a66b0f8896a7fd10cc
SHA1 hash:
1267a136f0525c3f841f728be5a1ea63a0b7f662
Link:
https://www.unpac.me/results/e8b2c9b4-14f5-4efe-a276-aa0babaa6637/
SH256 hash:
de960bd011c711c0d273c8d87c4e4f9a2c3d829f3ad4a96c5a175d8c8a86ec63
MD5 hash:
f8b7da12abb1b1c9273aab76aa0727b5
SHA1 hash:
938b6a4f2eade1880fc847ddbf1366a6c701e3f6
Link:
https://www.unpac.me/results/e8b2c9b4-14f5-4efe-a276-aa0babaa6637/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de960bd011c7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:AgentTeslaV5
Create hunting rule
Author:ClaudioWayne
Description:AgentTeslaV5 infostealer payload
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many email and collaboration clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many file transfer clients. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing Windows vault credential objects. Observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Generic_Threat_9f4a80b2
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_AgentTesla_ebf431a8
Create hunting rule
Author:Elastic Security
Reference:https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments