MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387
SHA3-384 hash: 3d73e0edd65092c8bbda3bf5a3316b64c1b5d6181bdd776c107f73b3896bd6c08f7c7a4289870f4f6cd15a0dee448696
SHA1 hash: 641a8cd33f334f6776792d880d13f5dbb57510be
MD5 hash: 146707650da4fa3e613c41dddf31e4e8
humanhash: monkey-freddie-cardinal-zebra
File name:bank detail.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:899'072 bytes
First seen:2023-07-25 07:39:45 UTC
Last seen:2023-07-31 06:54:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:qfgETK2jYiIoFwIrG3XCCaEHsbHQGQTCEsoE4RSjlKI5E3/7wHlqKylGP+tjmBvR:8xPjHIcTrGCSgGCEDson7mlq1lHT
Threatray 567 similar samples on MalwareBazaar
TLSH T1E015F12035A9AFA7C5BE43F85070327453FEAEAE6035E3096EC270DA5971F848621F57
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter cocaman
Tags:AgentTesla exe payment Shipping

Intelligence

File Origin
# of uploads :
5
# of downloads :
278
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
bank detail.exe
Verdict:
Malicious activity
Analysis date:
2023-07-25 07:53:55 UTC
Tags:
agenttesla stealer
Link:
https://app.any.run/tasks/fa2e250a-df40-46e8-b511-3d1102efae20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/432025/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.27636.24048.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Adding an exclusion to Microsoft Defender
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eca1ddc4-53d1-437f-9e2b-727c644f2339
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1278902
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1278902 Sample: bank_detail.exe Startdate: 25/07/2023 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic 2->53 55 Sigma detected: Scheduled temp file as task from temp location 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 3 other signatures 2->59 7 bank_detail.exe 7 2->7         started        11 qloKrdgBCP.exe 5 2->11         started        process3 file4 35 C:\Users\user\AppData\...\qloKrdgBCP.exe, PE32 7->35 dropped 37 C:\Users\...\qloKrdgBCP.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp7662.tmp, XML 7->39 dropped 41 C:\Users\user\AppData\...\bank_detail.exe.log, ASCII 7->41 dropped 61 Uses schtasks.exe or at.exe to add and modify task schedules 7->61 63 Writes to foreign memory regions 7->63 65 Allocates memory in foreign processes 7->65 67 Adds a directory exclusion to Windows Defender 7->67 13 RegSvcs.exe 15 2 7->13         started        17 powershell.exe 20 7->17         started        19 powershell.exe 19 7->19         started        21 schtasks.exe 1 7->21         started        69 Multi AV Scanner detection for dropped file 11->69 71 Machine Learning detection for dropped file 11->71 73 Injects a PE file into a foreign processes 11->73 23 RegSvcs.exe 11->23         started        25 schtasks.exe 11->25         started        signatures5 process6 dnsIp7 43 kbakr.com 162.241.27.28, 49708, 49710, 587 UNIFIEDLAYER-AS-1US United States 13->43 45 webmail.kbakr.com 13->45 51 2 other IPs or domains 13->51 75 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->75 77 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->77 79 May check the online IP address of the machine 13->79 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        47 webmail.kbakr.com 23->47 49 api.ipify.org 23->49 81 Tries to steal Mail credentials (via file / registry access) 23->81 83 Tries to harvest and steal browser information (history, passwords, etc) 23->83 33 conhost.exe 25->33         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-25 07:39:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
41
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=35zl4x462pavcsptpsh5xadigvkpiojfomlyg6ylno4w3rgkyodq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f5bc0b8bdc29c9e2d39e454e401a9c4763b13261b38564281ad13c69cbea07a
AgentTesla
1df31e1f77cb6e4a128c2eea27424948b7b8db593a958bf573ab95180f230eca
AgentTesla
5cbfb7154648241fbec88e87e2ea973816c38ee892344bd742dfc4aeb044fae3
AgentTesla
7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c
AgentTesla
c5dc5d0cc0ec3f2f607941f8d44019001ca18ab09abda656d4e68a5219d0e576
AgentTesla
c8ad050630ea954712c67d5c27e8f75542d78e7d43c81554c0a652da9218a880
AgentTesla
de3446d049a6b7189de5455bdd16e554dce659c21e7221520b131dd4a061d470
AgentTesla
f9c4bbc7b6a427a5fcd5d462d402456e604e7fcf1a21d350f3cc7f894f0e4484
AgentTesla
fe1140b9f51be2ad605b26a161f79839994aad33089412401912811eb6d569e0
AgentTesla
+ 557 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection
Link:
https://tria.ge/reports/230725-jhjy5acb5s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Unpacked files
SH256 hash:
53f2ad060cf771aa4f197df5789cee95959480c244a0b392bb450c8ce7311d77
MD5 hash:
37e82d3e2864e27b34f5fbacaea759c3
SHA1 hash:
a87024a466e052bff09a170bb8c6f374f6c84c32
Link:
https://www.unpac.me/results/0c1ea016-157a-4d2d-b63d-f03d12f162ea/
SH256 hash:
1b751819cf8367ce0a7da22032f49ed1b427751b7efa4b62fdcf48400951c1dd
MD5 hash:
6cb12dca792a7f2671063ab37afecf04
SHA1 hash:
a7d225fc1397870d361682b5e06e8f3b018b8970
Detections:
AgentTesla
Create hunting rule
Link:
https://www.unpac.me/results/0c1ea016-157a-4d2d-b63d-f03d12f162ea/
Parent samples :
0f5bc0b8bdc29c9e2d39e454e401a9c4763b13261b38564281ad13c69cbea07a
df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387
d254597f97b77a7c2e13c980947c0b19a24f21cea9226826c2a9bd13d7a5e335
9c1dfb4fb5b62214e9a1095dcb5e70f742e184fec69e70718c2fb46332a830f4
540e1e3418af9347bb2e87117af7e7a70a5fbf1bf00948d83020f4dec1b1466f
a01885eaecb0c9f8f63f0cd8d935e374f339c0e42f392885ab765f2b78977a2b
SH256 hash:
06238c620be8606c8cd7cd61ba937e405b8d45ecf937a7e659fc552406b6fcec
MD5 hash:
a075714ffe3b806a8ceafeba39c9bddd
SHA1 hash:
91499f2ccedb5a6af6f7ce48af3801113246d880
Link:
https://www.unpac.me/results/0c1ea016-157a-4d2d-b63d-f03d12f162ea/
SH256 hash:
1f5508fd987cef882b1d1d7447fad07538dba5ec2837164747010d7d34f84cfd
MD5 hash:
c5aad8a410114001d96b7bfbb14ebb41
SHA1 hash:
022b004933531075f0c58038b9370edd3a4bc547
Link:
https://www.unpac.me/results/0c1ea016-157a-4d2d-b63d-f03d12f162ea/
SH256 hash:
df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387
MD5 hash:
146707650da4fa3e613c41dddf31e4e8
SHA1 hash:
641a8cd33f334f6776792d880d13f5dbb57510be
Link:
https://www.unpac.me/results/0c1ea016-157a-4d2d-b63d-f03d12f162ea/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df72be5f9ed3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_EXE_Packed_GEN01
Create hunting rule
Author:ditekSHen
Description:Detect packed .NET executables. Mostly AgentTeslaV4.
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fc2c4a5f6322b630f47e96f641c8d34df456bf7adc04d15178d7bbdfefcf1442

AgentTesla

Executable exe df72be5f9ed3c15149f37c8fdb80683554f439257317837b0b6bb96dc4cac387

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 fc2c4a5f6322b630f47e96f641c8d34df456bf7adc04d15178d7bbdfefcf1442
Cape
Cape
https://www.capesandbox.com/analysis/432025/
  
Dropped by
SHA256 1d468a0850dc047793fc8f54cd4f91aba5f80bf60d568d3ce45b0c37182b8295
  
Dropped by
MD5 fe97ab5f742715e8f75c79d0b2d49994
  
Dropped by
MD5 4124be242fe54b7beeaff533fb26beb5

Comments