Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.GenericKD.39649730.16343.2439

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.GenericKD.39649730.16343.2439 (renamed file extension from 2439 to exe)
Analysis ID:	626423
MD5:	351a6ff6c8aef2f1f3fcc9cd8c0dfd8e
SHA1:	86b49c51155b6e3997a45e0ad1adef77722d4f6e
SHA256:	6099e48acdfc2f116c21d55e3aff1a1b7bc0d4c5841ee5506f762cd66935ca2e
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains functionality to register a low level keyboard hook

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe (PID: 3692 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe" MD5: 351A6FF6C8AEF2F1F3FCC9CD8C0DFD8E)

SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe (PID: 2560 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe MD5: 351A6FF6C8AEF2F1F3FCC9CD8C0DFD8E)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "v.saniuk@ibc.by", "Password": "QWErty654321", "Host": "webmail.active.by"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000000.272202502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.272202502.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.272808462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.272808462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.510960801.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.510960801.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.286867007.0000000003710000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.286867007.0000000003710000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.273600180.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.273600180.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.274625372.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.274625372.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.286449493.00000000035EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.286449493.00000000035EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.284509153.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.513468896.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.513468896.0000000002ED1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe PID: 3692	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe PID: 3692	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe PID: 2560	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe PID: 2560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30f6f:$s10: logins 0x309d6:$s11: credential 0x2cf99:$g1: get_Clipboard 0x2cfa7:$g2: get_Keyboard 0x2cfb4:$g3: get_Password 0x2e2af:$g4: get_CtrlKeyDown 0x2e2bf:$g5: get_ShiftKeyDown 0x2e2d0:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x6738f:$s10: logins 0x327d6:$s11: credential 0x66df6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x633b9:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x633c7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x633d4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x646cf:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x646df:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown 0x646f0:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.381cbe0.9.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30f6f:$s10: logins 0x309d6:$s11: credential 0x2cf99:$g1: get_Clipboard 0x2cfa7:$g2: get_Keyboard 0x2cfb4:$g3: get_Password 0x2e2af:$g4: get_CtrlKeyDown 0x2e2bf:$g5: get_ShiftKeyDown 0x2e2d0:$g6: get_AltKeyDown
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
4.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.35eec28.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.35eec28.7.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.35eec28.7.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x6ef8f:$s10: logins 0x6e9f6:$s11: credential 0x6afb9:$g1: get_Clipboard 0x6afc7:$g2: get_Keyboard 0x6afd4:$g3: get_Password 0x6c2cf:$g4: get_CtrlKeyDown 0x6c2df:$g5: get_ShiftKeyDown 0x6c2f0:$g6: get_AltKeyDown
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.3792bc0.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.3792bc0.8.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.3792bc0.8.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0xbcd8f:$s10: logins 0xf13af:$s10: logins 0xbc7f6:$s11: credential 0xf0e16:$s11: credential 0xb8db9:$g1: get_Clipboard 0xed3d9:$g1: get_Clipboard 0xb8dc7:$g2: get_Keyboard 0xed3e7:$g2: get_Keyboard 0xb8dd4:$g3: get_Password 0xed3f4:$g3: get_Password 0xba0cf:$g4: get_CtrlKeyDown 0xee6ef:$g4: get_CtrlKeyDown 0xba0df:$g5: get_ShiftKeyDown 0xee6ff:$g5: get_ShiftKeyDown 0xba0f0:$g6: get_AltKeyDown 0xee710:$g6: get_AltKeyDown
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.3792bc0.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4806b:$s1: file:/// 0x47f7b:$s2: {11111-22222-10009-11112} 0x47ffb:$s3: {11111-22222-50001-00000} 0x45a3a:$s4: get_Module 0x45ea9:$s5: Reverse 0xb9322:$s5: Reverse 0xed942:$s5: Reverse 0x47b4f:$s6: BlockCopy 0xbb216:$s6: BlockCopy 0xef836:$s6: BlockCopy 0xb95c3:$s7: ReadByte 0xedbe3:$s7: ReadByte 0x4807d:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.362ae48.6.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32d6f:$s10: logins 0x327d6:$s11: credential 0x2ed99:$g1: get_Clipboard 0x2eda7:$g2: get_Keyboard 0x2edb4:$g3: get_Password 0x300af:$g4: get_CtrlKeyDown 0x300bf:$g5: get_ShiftKeyDown 0x300d0:$g6: get_AltKeyDown
Click to see the 32 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "v.saniuk@ibc.by", "Password": "QWErty654321", "Host": "webmail.active.by"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe	Virustotal: Detection: 33%			Perma Link
Source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe	ReversingLabs: Detection: 43%

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe

Joe Sandbox ML: detected

Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8

Source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: AssemblyAlgorithmIdAttrib.pdb source: SecuriteInfo.com.Trojan.GenericKD.39649730.16343.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
SecuriteInfo.com.Trojan.GenericKD.39649730.16343.2439

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.GenericKD.39649730.16343.2439

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Windows Analysis Report
SecuriteInfo.com.Trojan.GenericKD.39649730.16343.2439