MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0
SHA3-384 hash: 2b5d9cff154455404ca000b0a64f080fc44de4f497fa3c94049f5b585aeeac0d5c984433ced8b1d3aa87506264bb4d20
SHA1 hash: 7e950607acc16f1bc065a1d190e1becd4f8cb3a5
MD5 hash: 6c8d53db08bbbe82de5e38959ad9001c
humanhash: hot-red-alaska-spring
File name:6c8d53db08bbbe82de5e38959ad9001c
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'064 bytes
First seen:2023-02-28 17:06:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:JfCRt2Jpk4voeWOJF9f8Y7APrWMxmaF2Wumx1zuGkYcvpOKWb+zr4MYIMxmmukRK:JW2HfrWOLG3AaF6mrICKqMYNL
Threatray 959 similar samples on MalwareBazaar
TLSH T1BEA40143FA2BC9A3D55542B7FEF3BF111F2589A498D36613059EACE0670A32A3C064DD
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6c8d53db08bbbe82de5e38959ad9001c
Verdict:
Malicious activity
Analysis date:
2023-02-28 17:09:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/135946c1-8a8e-4395-9d68-e9b4712b1ec5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/370696/
Detection(s):
Win.Trojan.EmbeddedDotNetBinary-9940868-0
Create hunting rule

Win.Trojan.EmbeddedReversedDLL-9940922-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63fe347ebbedb8176ff1c4ed/reports/bf2f6dde-b4e9-49a1-a61a-87d88a077045/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e756fd91-b5c0-404b-9c57-1da4b877e8e2
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1184492
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Encrypted powershell cmdline option found
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 817345 Sample: ekPba8s8gk.exe Startdate: 28/02/2023 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Antivirus detection for dropped file 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 9 other signatures 2->50 7 ekPba8s8gk.exe 16 6 2->7         started        12 download.exe 3 2->12         started        14 download.exe 14 3 2->14         started        process3 dnsIp4 32 api4.ipify.org 64.185.227.155, 443, 49695, 49697 WEBNXUS United States 7->32 34 api.telegram.org 149.154.167.220, 443, 49696, 49698 TELEGRAMRU United Kingdom 7->34 36 api.ipify.org 7->36 28 C:\Users\user\AppData\...\download.exe, PE32 7->28 dropped 30 C:\Users\...\download.exe:Zone.Identifier, ASCII 7->30 dropped 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 7->52 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->54 56 May check the online IP address of the machine 7->56 58 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->58 16 powershell.exe 15 7->16         started        38 173.231.16.76, 443, 49699 WEBNXUS United States 12->38 40 api.ipify.org 12->40 60 Tries to steal Mail credentials (via file / registry access) 12->60 62 Encrypted powershell cmdline option found 12->62 64 Tries to harvest and steal browser information (history, passwords, etc) 12->64 18 powershell.exe 12->18         started        42 api.ipify.org 14->42 20 powershell.exe 13 14->20         started        file5 signatures6 process7 process8 22 conhost.exe 16->22         started        24 conhost.exe 18->24         started        26 conhost.exe 20->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2023-02-28 12:48:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 25 (92.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46pawc5pxx44zq3n5kkepjxnmt4d32xz5oj7axilghje3g4lu7aa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e0879cc0de0ecb53e58aae88e162e02bba9f991907c443950a9c41aaf127763
AgentTesla
106e615cf4c53bf171b4dfc288bdddb82e3eddb407399bc18488cd2483f9d871
AgentTesla
1912f5c4fd7d4edda44d4e7a0db0b04329ac31103c3fb4b23030dbb9758d4b85
AgentTesla
21edd5d551bd3f5f03c073bf4af4a5493b142fedf0e8562c37ae05e3761bf8f3
AgentTesla
6e8160f23b32743ffdcd853036d351c0ec4410d61f28254854b0ec6abdfb4fc3
AgentTesla
7d142fc404d92deb83891ca5dacffbc9e9754797ed55b1562873a7b4c2c914b7
AgentTesla
8d3fd3eec10c029620dce7c9831690246513b13c94c949b0ad285439eebc9c07
AgentTesla
f1108b5eb80973aef37bd03b02d776a3bd44d9ec9425da749e4c8b22c0c16c67
AgentTesla
fa2301c017f32fbe205082b01c1608826ea7e7346739c338ff222648b0b14c89
AgentTesla
+ 949 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230228-vmeezscd39/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5577155192:AAEz6ZTkghx2RsdTxeeE-sDulPHc5WQblVg/
Unpacked files
SH256 hash:
db278336f41d93d84ecef41f7d740c6abcd922fe4984a7b7adbb70269e2c530f
MD5 hash:
0763f276df8a3f25b398e6639bb3e189
SHA1 hash:
c7a71bb8857ab44d2722511175f9355c91e4a4ea
Link:
https://www.unpac.me/results/705434ca-d49c-42c1-9da6-2ba0b2a5e299/
SH256 hash:
a8111f6a93eec114d5f0ae1e5b5d05a62fb5234762114dc8ef6a811381c186f8
MD5 hash:
d5daef0ddf54ed4b21742c680a37207d
SHA1 hash:
591007e11254183511112f4c31d7486065885360
Link:
https://www.unpac.me/results/705434ca-d49c-42c1-9da6-2ba0b2a5e299/
SH256 hash:
99ab1ab754ec1b48a4408afd1ea2ba62445944cd69c194dd0b0831429f6ac9d3
MD5 hash:
aa9abaaaef8edce4c73dc8276a4128ef
SHA1 hash:
07830eda93b91ed2dc28c6da4c0842407db85381
Link:
https://www.unpac.me/results/705434ca-d49c-42c1-9da6-2ba0b2a5e299/
SH256 hash:
e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0
MD5 hash:
6c8d53db08bbbe82de5e38959ad9001c
SHA1 hash:
7e950607acc16f1bc065a1d190e1becd4f8cb3a5
Link:
https://www.unpac.me/results/705434ca-d49c-42c1-9da6-2ba0b2a5e299/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e79e0b0bafbd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Reverse_DOS_header
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects an reversed DOS header
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe e79e0b0bafbdf9ccc36dea9447a6ed64f83deaf9eb93f05d0b31d24d9b8ba7c0

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2553587/
Cape
Cape
https://www.capesandbox.com/analysis/370696/

Comments


Avatar
zbet commented on 2023-02-28 17:06:06 UTC

url : hxxp://23.94.96.9/3208/vbc.exe