MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe
SHA3-384 hash: 771124255a86732f63e90be7183473ca134327564a7d69cf8146bf8c23ff0cf311f8774d56c842da264876a1a056239e
SHA1 hash: e9d99a9dac85a4a42f6c784046cc5ccb826be120
MD5 hash: 5fde03f41ae673fd5fe71803245e7876
humanhash: low-louisiana-mockingbird-vegan
File name:RFQ.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:841'216 bytes
First seen:2020-10-13 13:53:08 UTC
Last seen:2020-10-13 14:58:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:Kn4qOXHn/G0tOCOFtNIA0mhh42dIBQh0fuHE2/jUUAVtS55Qz049KI7mggMNUvgW:KIXf73Ofp0mhyOUYD/inS0zLFqK538
Threatray 524 similar samples on MalwareBazaar
TLSH F605F0F93A686E17EA7D2EF5D0D8128483F526C330BBDAD92DC111DF7AC5B861611283
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70486/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.8319.29797.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/489791
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 297341 Sample: RFQ.exe Startdate: 13/10/2020 Architecture: WINDOWS Score: 100 43 mail.logresultbox.xyz 2->43 59 Found malware configuration 2->59 61 Antivirus detection for dropped file 2->61 63 Antivirus / Scanner detection for submitted sample 2->63 65 10 other signatures 2->65 8 RFQ.exe 8 2->8         started        12 fecapp.exe 7 2->12         started        14 fecapp.exe 4 2->14         started        signatures3 process4 file5 35 C:\Users\user\AppData\...\ThoryzESPzFGGy.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\...\tmp9BBF.tmp, XML 8->37 dropped 39 C:\Users\user\AppData\Local\...\RFQ.exe.log, ASCII 8->39 dropped 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->67 69 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->69 71 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->71 79 2 other signatures 8->79 16 RFQ.exe 2 11 8->16         started        21 schtasks.exe 1 8->21         started        73 Antivirus detection for dropped file 12->73 75 Multi AV Scanner detection for dropped file 12->75 77 Machine Learning detection for dropped file 12->77 23 fecapp.exe 12->23         started        25 schtasks.exe 12->25         started        signatures6 process7 dnsIp8 41 mail.logresultbox.xyz 198.54.125.197, 26, 49747, 49748 NAMECHEAP-NETUS United States 16->41 31 C:\Users\user\AppData\Roaming\...\fecapp.exe, PE32 16->31 dropped 33 C:\Users\user\...\fecapp.exe:Zone.Identifier, ASCII 16->33 dropped 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->45 47 Moves itself to temp directory 16->47 49 Tries to steal Mail credentials (via file access) 16->49 57 3 other signatures 16->57 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 21->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 21->53 27 conhost.exe 21->27         started        55 Installs a global keyboard hook 23->55 29 conhost.exe 25->29         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe/
Threat name:
ByteCode-MSIL.Backdoor.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 03:42:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4qh4nnywy7hpwcjs46nrsjf5xlsaixm2ml56ftd67coienmwn67a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3b62f6df8fd191bcfeadb11e9db80286925b1022deb0b5baf7d044faeb648b5b
AgentTesla
44c8acbbe1fdbcab7397c03bc91d5d3f440ec11f6358974e4bcc27ee28a4b838
AgentTesla
4ad80d29a42caae7aea0c2f789f6f1b7f104f98de269777be04b8cbde41e2678
AgentTesla
557e3c6a577287caee9f2224e8ef8455d4501f7d99c4ae818dd4d8aa268ed495
AgentTesla
5e082ed595236d19176b95e02863e7726e36b98a782ce6f8b893667b90b878bb
AgentTesla
6260dbcc6761d180c1508ecffe439c762d74b6149d1c2c48926e7e0bf0d2739f
AgentTesla
8a926e1548b8ad5379c12ec3556049bddf38a042c9c255db4674b752788f7d79
AgentTesla
a569b8008c92f448c7263b95e26aa73165682eb25778cafe76f45838c7ffdad5
AgentTesla
bf993f6195527053ecdbb6c83a6ddd94528d867b26e04cdebbbcb6f3bfd813c8
AgentTesla
d58538fee18c00f55def8bcaee383bc186440ddd55cb24ab8840cab62183e2ab
AgentTesla
+ 514 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion persistence
Link:
https://tria.ge/reports/201013-earjjc7cvn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe
MD5 hash:
5fde03f41ae673fd5fe71803245e7876
SHA1 hash:
e9d99a9dac85a4a42f6c784046cc5ccb826be120
Link:
https://www.unpac.me/results/d81aa76b-78af-4ed5-8119-c7862f56739c/
SH256 hash:
969654edb15272e98832ffc6976d281a64cf694758bcd584152cf838c5d718df
MD5 hash:
9b91f88967bb507e1a6ab92909e04f9a
SHA1 hash:
0b6e3da32728cb3100416d81470322e83bf4c497
Link:
https://www.unpac.me/results/d81aa76b-78af-4ed5-8119-c7862f56739c/
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/d81aa76b-78af-4ed5-8119-c7862f56739c/
SH256 hash:
c2e0731067b30fa075fbf84ddf7400d36998ecaf3b6de33effcfb76c9f802c95
MD5 hash:
6ed413dbc38f7eb80943df588f4ae9ec
SHA1 hash:
dd13e70e9f6a23b6ba1a28f55fcb23e5e0a52232
Link:
https://www.unpac.me/results/d81aa76b-78af-4ed5-8119-c7862f56739c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e40fc6b716c7cefb0932e79b1924bdbae4045d9a62fbe2cc7ef89c8235966fbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/70486/

Comments