MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de
SHA3-384 hash: ed473edd833bfb3f7c4e8cfa22075e9cd2fba0b822439858799a2c9b3b3a218deaaf936afe6055a448ef480f4d1fbc88
SHA1 hash: bd7972f34d6d0c502d6c3d34a66d824655cf8bc1
MD5 hash: 64ffc840705b1bda0155a798343f14ce
humanhash: lemon-black-eleven-table
File name:fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'201'152 bytes
First seen:2021-08-30 06:26:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:+1j4MROxnFt3GfrrcI0AilFEvxHP2oou:+iMijmrrcI0AilFEvxHP
Threatray 73 similar samples on MalwareBazaar
TLSH T18B45BE013BACED16C1BE3678A6731AE80778FC06A452FA4B286473AD1DBB701BD15357
dhash icon 72329aca92b37360 (1 x AgentTesla)
Reporter JAMESWT_WT
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
svhost.exe
Verdict:
Malicious activity
Analysis date:
2021-08-15 10:01:53 UTC
Tags:
rat orcus
Link:
https://app.any.run/tasks/db5aa120-b756-45dc-bce2-c40e95b3751d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
OrcusRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/183567/
Detection(s):
Win.Packed.Passwordstealera-9752380-0
Create hunting rule

Win.Packed.Passwordstealera-9803747-0
Create hunting rule

Win.Packed.Generic-9805849-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a service
Creating a file
Launching a service
Sending a UDP request
Creating a file in the Program Files subdirectories
Enabling the 'hidden' option for recently created files
Creating a window
DNS request
Connection attempt
Creating a file in the %AppData% directory
Sending a custom TCP request
Unauthorized injection to a recently created process
Enabling autorun for a service
Enabling autorun by creating a file
Malware family:
Orcus RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/403f14d1-83c2-4fca-becd-24ff5bda1e62
Result
Threat name:
Orcus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/841291
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to disable the Task Manager (.Net Source)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Yara detected Costura Assembly Loader
Yara detected Orcus RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473728 Sample: 8GxLojRybe Startdate: 30/08/2021 Architecture: WINDOWS Score: 100 48 4.tcp.ngrok.io 2->48 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for dropped file 2->60 62 Antivirus / Scanner detection for submitted sample 2->62 64 10 other signatures 2->64 9 8GxLojRybe.exe 10 2->9         started        13 svchost.exe 2->13         started        15 svchost.exe 9 1 2->15         started        18 11 other processes 2->18 signatures3 process4 dnsIp5 40 C:\Windows\SysWOW64\WindowsInput.exe, PE32 9->40 dropped 42 C:\Program Files (x86)\...\Watchdog.exe, PE32 9->42 dropped 44 C:\Windows\SysWOW64\WindowsInput.exe.config, XML 9->44 dropped 46 3 other malicious files 9->46 dropped 72 Drops executables to the windows directory (C:\Windows) and starts them 9->72 20 Watchdog.exe 5 9->20         started        25 WindowsInput.exe 2 4 9->25         started        74 Changes security center settings (notifications, updates, antivirus, firewall) 13->74 27 MpCmdRun.exe 13->27         started        56 127.0.0.1 unknown unknown 15->56 file6 signatures7 process8 dnsIp9 50 4.tcp.ngrok.io 3.131.147.49, 17891, 49706, 49709 AMAZON-02US United States 20->50 52 3.136.65.236, 17891, 49832, 49833 AMAZON-02US United States 20->52 54 3 other IPs or domains 20->54 36 C:\Users\user\AppData\Roaming\Watchdog.exe, PE32 20->36 dropped 38 C:\Users\user\AppData\...\Watchdog.exe.config, XML 20->38 dropped 66 Protects its processes via BreakOnTermination flag 20->66 29 Watchdog.exe 20->29         started        68 Antivirus detection for dropped file 25->68 70 Multi AV Scanner detection for dropped file 25->70 32 conhost.exe 27->32         started        file10 signatures11 process12 signatures13 76 Antivirus detection for dropped file 29->76 78 Multi AV Scanner detection for dropped file 29->78 34 Watchdog.exe 29->34         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de/
Threat name:
ByteCode-MSIL.Trojan.Orcus
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 10:49:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
37 of 46 (80.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7sbvdrijx7lpziqwr55vmuqyjk2n2jz25bo2exxh75iavbdxw7pa._file
Verdict:
malicious
Similar samples:
1a4284cd084b609aa03892894e379c630505b5e4b9ccfc278138d36668f4526f
AgentTesla
28027fae1edf2324a8165c9f1a82273f958385c4947e8750a6bdcf29ec2e4906
AgentTesla
50c1c541f9daea24b578ac94fd709b1214207a38cbc2ba3b36b2b0e81d0e4ee1
AgentTesla
53943895601cbc79561cb30c9957715400d82a255d97ce36fe1b383bf3c240da
AgentTesla
5fe03c646fcc7a7b912b2266fe54c645f203d22bfae171bf5f089e9934711dbb
AgentTesla
6a95a31549b0ce73fc61664173ebab87da541094d8749894f05c707e543cbe1e
AgentTesla
bf5d5c28bec7bdcf41fad771fd465ba6bb9a56e053c9470a6e10293466109d3c
AgentTesla
d7f7b600a0291f227e18c700916cbd7552aeb595e51a1ab918e164255cc29b1b
AgentTesla
da027d0065fa09308efb93370437a0495a3bcec56325fb9846d807066a9abf86
AgentTesla
e7e7d51e82941b9eb56f82854e9682dc7a8593185ce6216082d5f795ceace582
AgentTesla
+ 63 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus rat spyware stealer
Link:
https://tria.ge/reports/210830-ndbbjtcw1e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Orcurs Rat Executable
Orcus
Orcus Main Payload
Malware Config
C2 Extraction:
4.tcp.ngrok.io:17891
Unpacked files
SH256 hash:
fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de
MD5 hash:
64ffc840705b1bda0155a798343f14ce
SHA1 hash:
bd7972f34d6d0c502d6c3d34a66d824655cf8bc1
Link:
https://www.unpac.me/results/040ee5b7-3116-47df-b730-e8f99e538c12/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:MAL_BackNet_Nov18_1
Create hunting rule
Author:Florian Roth
Description:Detects BackNet samples
Reference:https://github.com/valsov/BackNet
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/183567/

Comments