MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3
SHA3-384 hash: 316bbe6c676dad5089aa766e6f2ed4661c8c05d9afd5532e72679a024edf6229b0c686e07cd55979e28a86297f9eede8
SHA1 hash: d648c119285e4058c4d6c393c484bb548fa31356
MD5 hash: 1ed382c9c50e007dc08d871562b9d6cd
humanhash: december-juliet-seventeen-kilo
File name:rCotizacion07907.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:633'344 bytes
First seen:2023-04-19 16:09:32 UTC
Last seen:2023-04-20 13:07:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:kkVf1QeYBbuHTJzLyUVXkVWYgeBoA1PRVk41404Ko5dTp9:nVfSeYBQdzLbV0BgOPVko4l5dd
Threatray 2'305 similar samples on MalwareBazaar
TLSH T161D4D1C467A5D7A2C2647FBC127A70742FB0589BE566CA75FE8850D93D32FC81A1038B
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter FXOLabs
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
245
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rCotizacion07907.exe
Verdict:
Malicious activity
Analysis date:
2023-04-19 16:36:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/55de250f-1122-44b3-9044-df04db2d1477

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/383474/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/644012648c1908d5b414cd83/reports/ade5c5fa-5400-4ca1-8084-5409fe1d8ecc/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/55c7dba6-0e57-4da3-a7b3-625572049ea4
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1217258
Signature
.NET source code contains potential unpacker
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2023-04-19 16:10:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
22 of 37 (59.46%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=57fyamcd4yaadlvhg7iagozlshcs2or5cpi4eleu66krdt7nc6rq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09d16715756085ded7748ecdaea1e54e91304db6471ad9b79deeafe64e390224
AgentTesla
23af85d9373c400f00f17590112f4545c9a522427bf6e1de80dcb028b8538bbd
AgentTesla
3ddcca47351b6564585e8092bc5661cecd43d2a14050531843d1afdfbfcb7dfa
AgentTesla
416d574131255e4656d9d548ef7c74c1ba3850aa80a9acd9dbd0352eb03053ee
AgentTesla
5c205cffc83f7be274773fb1c3aa356b29d97e4d62a83e79c5fd52eadc3ed695
AgentTesla
8fcc45ad91c946c56a807d763576062e0a427539b9cb7fe2deb239b1da98e775
AgentTesla
911726d8a917e91553bc20985c0b4562768ba02202b5555be7a0e6ff6e0797c3
AgentTesla
9d83a9e060a29f32c19203afbffe3e6b3d22d71ec4779bc7139c0b22a9881e65
AgentTesla
a64f5b5615ebe7e09f5238788ab1e6dfc6e00acc1741ecceba0fbf3930389273
AgentTesla
c7afa76d4d1a5546ea2c384d69b1d167306bd1f71dbcc848cfb77cd964c5e71a
AgentTesla
+ 2'295 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/230419-tmd9jsdf7x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
bdbd026f9934455fa3e429868b71fbfa794f771911c6228bacb58b83dd1d76b2
MD5 hash:
c7a8e0a564dadd903fe53bf2d4d5c082
SHA1 hash:
e769102f07cd6b470ecc3a3693b8467d78113875
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
SH256 hash:
926dc54e77cbf0d8a817574ed2c5be33880a5c128910ecf5e472c243a1e27a71
MD5 hash:
dfe4719059e35cbcc1b812bdf6d70be3
SHA1 hash:
9f2ac058b3b8feef2035c3a66f80494c93e6ec4a
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
SH256 hash:
05dd384a800420068c248620c789dbdfdf848803249bdde604214d948d3af4c8
MD5 hash:
71655b1e60b6793b81a405414c711ad3
SHA1 hash:
5ad4d2555815e0c033667fc3cbd58e68fab11f3b
Detections:
AgentTeslaXorStringsNet
Create hunting rule
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
SH256 hash:
dd2c6938048262e1b5e8c054529404ed3a135528822c9cb4fca3658c3ac0d863
MD5 hash:
3512ea4f44115ccb6eb7edefba0dc93e
SHA1 hash:
555186c062fa54a37c368a4d21c5eb6c51795dbe
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
SH256 hash:
5e5c8fe4e53980a98b48fe6b19155edf0f0d285ed899c61dbf4f880583ddf1d2
MD5 hash:
b3bbc5461d12f07ea893bf415dfe7c89
SHA1 hash:
40c3156c471d2afe3fd88c7d20cf93e5782e1bd6
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
SH256 hash:
efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3
MD5 hash:
1ed382c9c50e007dc08d871562b9d6cd
SHA1 hash:
d648c119285e4058c4d6c393c484bb548fa31356
Link:
https://www.unpac.me/results/a3038aa7-8b70-4883-b688-dfdc0af97863/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/efcb803043e6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe efcb803043e60001aea737d0033b2b91c52d3a3d13d1c22c94f79511cfed17a3

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/383474/

Comments