MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e447c6fe2e22399d51f4b8ba15ca97b7c783726c863e31419ac6cd13de00a51b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e447c6fe2e22399d51f4b8ba15ca97b7c783726c863e31419ac6cd13de00a51b
SHA3-384 hash: 00cd255c5fd1dbd30c1dc90eced12fdc7ff355e298ef4a33e0e2258df88b37b81df4f258dbb96d5ef96e38cab264f548
SHA1 hash: bcd8d0381f5fcfb239bb0c529f0e2e6bd922bfcf
MD5 hash: 4f88c8bb57e677daf73bd8b33e50ca97
humanhash: diet-hamper-montana-twelve
File name:Payment Copy_ Lloyds Bank_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:28'672 bytes
First seen:2021-12-03 09:52:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:v2JWfO+ogmmmTmsxk7LwLTqMPAJUbLiLPdMpTI37/4vNesRBpa:PogmmmTmsxc0FRePdEWEHp
Threatray 13'254 similar samples on MalwareBazaar
TLSH T1C9D2B501F550C3B2D3A6663B74DDB14CF2BEAD2E060BD99EE8A07D5C06B12811DF666C
File icon (PE):PE icon
dhash icon 64e4c8d0f0e8d4d4 (56 x AgentTesla, 7 x RemcosRAT, 5 x NanoCore)
Reporter abuse_ch
Tags:AgentTesla exe Lloyds

Intelligence

File Origin
# of uploads :
1
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Copy_ Lloyds Bank_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-12-03 10:37:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c76f2eb6-28d6-4dc4-a0cd-1b494254c5bd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/210985/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a window
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61a9e8cdfa72c81b5b092de1/reports/0ffe02b6-c12a-4e2a-99c6-4bc7abb384e2/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/38bfa77f-6ea9-461a-a13d-60cb09ffe6b1
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/900755
Signature
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Uses ping.exe to check the status of other devices and networks
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e447c6fe2e22399d51f4b8ba15ca97b7c783726c863e31419ac6cd13de00a51b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-03 09:53:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4rd4n7roei4z2upuxc5blsuxw7dyg4tmqy7dcqm2y3grhxqauunq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08a29dc6fe654440e5f4381b8394a4dc30da8b994e0d0a2e1cb9ef32591fb13f
AgentTesla
4b2d7c3ea69eef113fb46184310c3f1579d2545c0f618da316b237e25c12f97c
AgentTesla
5aa7d1bc7abef93b3ccd50f7dd880f9bf70c7b7d157d067f16377d7b0a929092
AgentTesla
f0989d4ad8e20e8058adbbd82ec73fed0af327ad40439038bc3cd09ff7ae765f
AgentTesla
fa43ff43e62190b7aca9fe262c93f05287cf09bbaa1fca2de5cf704883581eec
AgentTesla
ff89ced611d4ad5167bec7392316bd7a75c45cfdde67d26f248178aa728b263c
AgentTesla
+ 13'244 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211203-lv4keabae7/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
e447c6fe2e22399d51f4b8ba15ca97b7c783726c863e31419ac6cd13de00a51b
MD5 hash:
4f88c8bb57e677daf73bd8b33e50ca97
SHA1 hash:
bcd8d0381f5fcfb239bb0c529f0e2e6bd922bfcf
Link:
https://www.unpac.me/results/a023a060-d918-4225-a1cc-c81cd46b0059/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e447c6fe2e22/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e447c6fe2e22399d51f4b8ba15ca97b7c783726c863e31419ac6cd13de00a51b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/210985/

Comments