MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6fc5ef25d54d2eb8c1ccc7102bd339f6eea29e365a42e948c8260da5593cb80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6fc5ef25d54d2eb8c1ccc7102bd339f6eea29e365a42e948c8260da5593cb80
SHA3-384 hash: 03cfa75951579775201ca4ff9d9780d9b79621c3159b934e57ff9f5f396d46d6aef74dbc53b0849a049b6066e63642da
SHA1 hash: 6f1a98e43a3ea57a59b47ae4105e0f18ad30ae95
MD5 hash: cc1589cba294f66f9d61b3c209f4a165
humanhash: music-emma-double-echo
File name:Ordine di acquisto AA23005838.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:662'016 bytes
First seen:2023-01-23 14:53:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:9C66Bm2iNNWiTuYPCHSIs2+3m/tx2ZH2Ur9jkhSGF5x66B:YVM1rW6rIs2+m/CZWokhFF5xV
Threatray 25'173 similar samples on MalwareBazaar
TLSH T1AFE4F1822D64C519F2F51FBD0E6C962D8FB45C8923E3E2B40BE674E9A5B3B43C415872
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter JAMESWT_WT
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
191
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ordine di acquisto AA23005838.exe
Verdict:
Malicious activity
Analysis date:
2023-01-23 14:54:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/783b8980-2356-409d-85bf-4265bb671844

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/355913/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63ce9f8d447edb203a0067de/reports/da458eb3-4662-4309-a450-a8f7db7fe81e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2730d3a6-3084-4ca0-85d7-862ec68c7264
Result
Threat name:
AgentTesla, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1157076
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6fc5ef25d54d2eb8c1ccc7102bd339f6eea29e365a42e948c8260da5593cb80/
Threat name:
ByteCode-MSIL.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-01-23 12:41:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=636f54s5ktjoxda4zryqfpjtt5xoukpdmwsc5femqjqnuvmtzoaa._file
Verdict:
malicious
Similar samples:
01b0e10d7351007133aa2a5f1cef379b855706256fb70f327990ea142df772ad
AgentTesla
0b0203248a9c024b4faa835a5b1968805f203b35484ac7b938fe2ce36a182dab
AgentTesla
106e615cf4c53bf171b4dfc288bdddb82e3eddb407399bc18488cd2483f9d871
AgentTesla
24902a43196fd02d2939443510181c165980bd71e889dcff559ca25153c76d81
AgentTesla
a7d2bd1e968aea0e81664aa5aabd428a57d12bc8573611543ad72a57661180b8
AgentTesla
ae962654831c5e0f03bbe7764978c5044ee708f93eb7e485e2e86ec860b8fab5
AgentTesla
d9d9e3cc542fd9391c9ae953b0071b0a4a450df7d6e3e5563df812b128ab2620
AgentTesla
e19bcbf0c3ca0fe5e246cede2ef4ee264d0908faf4ca4b39aeb687c443f85f91
AgentTesla
ff5610cfb67d17c4e2d8f311146834c4d70680d10173a5b1ce39ea7aa3183a93
AgentTesla
+ 25'163 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection spyware stealer
Link:
https://tria.ge/reports/230123-r9v5gafd3x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
aefae14ee883a5471f6e3b7e78aaeda57bf154a7d0fb1f4520238ae054e83757
MD5 hash:
a1b4b2a3e35207070137a72cd029b427
SHA1 hash:
61635cc9f764bd0ce6e5b0537fd825893a98725a
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
SH256 hash:
0476cfef804a0a041248ba67fcb0d13a5fc7c664d67f926ab9c41a888d9ed9be
MD5 hash:
c0d07b2db28c1353c7cb2125fd9d4fe5
SHA1 hash:
43e6dff7df401a3d0dad7e375a0c160fa01867ed
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
SH256 hash:
ff1b42ea7d56a37eae801adbddb7116f52a4664c0b41302736f522852edc2747
MD5 hash:
89ac57478044c57c7195943116a521e0
SHA1 hash:
1ff2bafeed795423e3538d810bda8e1e3fcdcfa5
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
SH256 hash:
20eda0a9b642a495ee216f13d2c37603ef860ff1aa1b8c89b2aa630a17574f71
MD5 hash:
d2dcd2d712c1f3c871e39fc27f889546
SHA1 hash:
167502f0388eb8c9525a048282600fa83d7254ad
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
SH256 hash:
841d511f99444a0671abbeef04b3876019e1b2c779276a56ca243799fa1526f3
MD5 hash:
90c46b7f66d51cb00c089225ec28acf6
SHA1 hash:
0e319f405fac0117a291cc5178a326682375c45d
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
SH256 hash:
f6fc5ef25d54d2eb8c1ccc7102bd339f6eea29e365a42e948c8260da5593cb80
MD5 hash:
cc1589cba294f66f9d61b3c209f4a165
SHA1 hash:
6f1a98e43a3ea57a59b47ae4105e0f18ad30ae95
Link:
https://www.unpac.me/results/e0fe72bc-c1c4-4b43-9488-d5182b91aaf0/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f6fc5ef25d54/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/f6fc5ef25d54d2eb8c1ccc7102bd339f6eea29e365a42e948c8260da5593cb80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/355913/

Comments