MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 12 File information Comments

SHA256 hash:	f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1
SHA3-384 hash:	1ac3bdbe783d9dea5d5a7a9aff2d945faad4e4e107b25bf39baa4a51b235b762a4a42a34e4f5cf31a291a9dc6ea5158a
SHA1 hash:	715bdd824d928f000533d0fcd1c84c0fca424077
MD5 hash:	3f79e71d64c7ee0acf4ead0466968bdb
humanhash:	autumn-white-winner-snake
File name:	f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'984'512 bytes
First seen:	2021-02-28 16:12:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	24576:IryNeq3JXf3jJ1TWaL6Iq+uNJhj8Y/fYdhhUF54clNf7+6uHAW92zt/sWu2BSMCw:Iuoq3R7TTeNJBdfY/o54clgLH+tkWJ0
Threatray	1 similar samples on MalwareBazaar
TLSH	2F95010423EC435BE5BF2B75E0B255A1C3B1F522B56ECB8F6C1469ED2D22358DA007A7
Reporter	c3rb3ru5d3d53c2
Tags:	AgentTesla

c3rb3ru5d3d53c

@c3rb3ru5d3d53c Live Hunt

Intelligence

File Origin

# of uploads :

# of downloads :

566

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

RustCheat.exe

Verdict:

Malicious activity

Analysis date:

2021-02-28 15:01:45 UTC

Tags:

evasion stealer trojan echelon

Link:

https://app.any.run/tasks/36a01e53-572c-4407-b2a7-801aa27fdf98

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/120026/

Detection(s):

Win.Packed.GrandSteal-9783630-1

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

DNS request

Sending a custom TCP request

Sending a UDP request

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Creating a file in the %temp% directory

Deleting a recently created file

Replacing files

Creating a window

Sending an HTTP GET request

Moving a file to the %AppData% subdirectory

Connection attempt

Sending an HTTP POST request

Creating a file

Stealing user critical data

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/621400

Signature

Antivirus / Scanner detection for submitted sample

Binary contains a suspicious time stamp

Detected VMProtect packer

Found C&C like URL pattern

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1/

Threat name:

ByteCode-MSIL.Trojan.DataStealer

Status:

Malicious

First seen:

2021-02-28 16:13:07 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7f7t3ohx66mjlodd6pyuj2g7lym5uiydlydh6mv65uadxjwbcxiq._file

Verdict:

suspicious

AgentTesla

Result

Malware family:

n/a

Score:

8/10

Tags:

spyware vmprotect

Link:

https://tria.ge/reports/210228-sbz5ceh4ws/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Looks up external IP address via web service

Reads user/profile data of web browsers

VMProtect packed file

Unpacked files

SH256 hash:

3d13d8434d6d637fa4fa06663baaa52e8054865f5b857459b01810e1e5e0c981

MD5 hash:

b7bcc5aefceb227163f649e608528f4a

SHA1 hash:

eb59e15db3290d4275a073282d840301d7ac18a4

Link:

https://www.unpac.me/results/db56ea01-1e03-4a2b-a0b6-c58783b906c4/

SH256 hash:

f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1

MD5 hash:

3f79e71d64c7ee0acf4ead0466968bdb

SHA1 hash:

715bdd824d928f000533d0fcd1c84c0fca424077

Link:

https://www.unpac.me/results/db56ea01-1e03-4a2b-a0b6-c58783b906c4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

DataStealer

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f97f3db8f7f79895b863f3f144e8df5e19da23035e067f32beed003ba6c115d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	Cryptocoin_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Steam in files like avemaria

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_Messaging_Clients Create hunting rule
Author:	@ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Stealer_word_in_memory Create hunting rule
Author:	James_inthe_box
Description:	The actual word stealer in memory

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/