MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd
SHA3-384 hash: 6d2f4d455869efa51014db2db373d63a017f4c0df901a8c0d337e7a531b57545e1deaf5bad6a0ac9d14237c57bd052e4
SHA1 hash: d8f63c650caef24e8e2fe14bce9651bf0e0d3284
MD5 hash: d4c8df09dcfba97a30b64b931791edc1
humanhash: aspen-nine-alabama-delta
File name:ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:107'520 bytes
First seen:2023-07-28 10:11:17 UTC
Last seen:2023-09-08 09:48:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:xMwSOJx44VvmKil0afZKKK3A3VL+o0nHi6TWKxp9KQqex07H0l1RijBF9PbKt:DHVvoNfZBD3VyokHi61RbGH0l1wF3E
Threatray 2'380 similar samples on MalwareBazaar
TLSH T1C8B3F707BA8ED9F1C2486B3AC1CBD01603ADDA96F373D60BB54E23561A033EE594564F
TrID 69.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.0% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
1.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Reporter TeamDreier
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
268
Origin country :
DK DK
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
ORDER.exe
Verdict:
Malicious activity
Analysis date:
2023-07-28 10:14:18 UTC
Tags:
stealer agenttesla
Link:
https://app.any.run/tasks/0411f706-4d1a-42e9-b824-03a3f0c74748

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/435889/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.68393016.21305.28512.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control lolbin masquerade packed
Link:
https://www.filescan.io/uploads/64c3947480fc6008e9221028/reports/a741b8c1-5437-4e79-b7fd-f6c989081ee0/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8611659e-0cdd-4512-a32d-44642b4bb4c4
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1281757
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected Costura Assembly Loader
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1281757 Sample: ORDER.exe Startdate: 28/07/2023 Architecture: WINDOWS Score: 100 59 melangere.com 2->59 61 mail.melangere.com 2->61 75 Malicious sample detected (through community Yara rule) 2->75 77 Antivirus / Scanner detection for submitted sample 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 7 other signatures 2->81 10 ORDER.exe 16 6 2->10         started        15 Sgybll.exe 14 4 2->15         started        17 Sgybll.exe 2->17         started        signatures3 process4 dnsIp5 73 qu.ax 46.29.235.10, 443, 49698, 49702 EUROTELECOM-ASRU Russian Federation 10->73 53 C:\Users\user\AppData\Roaming\Sgybll.exe, PE32 10->53 dropped 55 C:\Users\user\...\Sgybll.exe:Zone.Identifier, ASCII 10->55 dropped 57 C:\Users\user\AppData\Local\...\ORDER.exe.log, ASCII 10->57 dropped 91 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->91 93 Injects a PE file into a foreign processes 10->93 19 ORDER.exe 2 10->19         started        23 cmd.exe 1 10->23         started        25 ORDER.exe 10->25         started        95 Antivirus detection for dropped file 15->95 97 Multi AV Scanner detection for dropped file 15->97 99 Machine Learning detection for dropped file 15->99 27 cmd.exe 15->27         started        29 cmd.exe 17->29         started        file6 signatures7 process8 dnsIp9 63 melangere.com 96.127.149.186, 49699, 49706, 49707 SINGLEHOP-LLCUS United States 19->63 65 mail.melangere.com 19->65 83 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->83 85 Tries to steal Mail credentials (via file / registry access) 19->85 87 Tries to harvest and steal browser information (history, passwords, etc) 19->87 31 powershell.exe 20 23->31         started        33 conhost.exe 23->33         started        35 Sgybll.exe 27->35         started        39 conhost.exe 27->39         started        41 Sgybll.exe 29->41         started        43 conhost.exe 29->43         started        signatures10 process11 dnsIp12 67 qu.ax 35->67 89 Injects a PE file into a foreign processes 35->89 45 cmd.exe 35->45         started        47 Sgybll.exe 35->47         started        69 192.168.2.1 unknown unknown 41->69 71 qu.ax 41->71 signatures13 process14 process15 49 conhost.exe 45->49         started        51 powershell.exe 45->51         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2023-07-27 17:34:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6j6ghct566uesmlqmxg7gt5ombi6rxabvnlfptzxfgvl2kqxxo6q._file
Verdict:
malicious
Similar samples:
114210ddeecbf5dd4320338e5a3c5a156841ae1390732a2b71e324f161e32932
AgentTesla
211809c137b352584707b7d3b254df7e9b80302615f758ff8060b535d8804945
AgentTesla
3f0f7847996e9d8ef9f875c1c20dafd17ecb2a3eee860b2d08ac5eabab631b4d
AgentTesla
53fe49ca446d7a64bca8c7e40ceee6254302f0601478a8039a14296d20aafc6a
AgentTesla
654fa85db466a2d46ac499f06d295e04910c31b647ca787e4f96aa92628cba83
AgentTesla
b8a7a98af1a8c447cd01719ad921f645bf56f293fb7efab345874dc6a04f597f
AgentTesla
edce8f80d69409249e3811bb8b8347bb8151147fd186f0c8847085d2840193be
AgentTesla
f8a98f6720565d1ac05e9c1342e5bd669f46afe61626172cf4a692dd40822294
AgentTesla
fb9295be3b011faf14a3e3d382a24eb47cf8877f3fcbf2bbc598c92cf3a48181
AgentTesla
+ 2'370 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection persistence spyware stealer
Link:
https://tria.ge/reports/230728-l8g9bsdd8w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd
MD5 hash:
d4c8df09dcfba97a30b64b931791edc1
SHA1 hash:
d8f63c650caef24e8e2fe14bce9651bf0e0d3284
Link:
https://www.unpac.me/results/9779b491-d904-4856-9bfe-4c983896c695/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe f27c638a7df7a849317065cdf34fae6051e8dc01ab5657cf3729aabd2a17bbbd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/435889/

Comments