Edit tour

Windows Analysis Report
Halkbank_Ekstre_20220513_082357_541079.exe

Overview

General Information

Sample Name:	Halkbank_Ekstre_20220513_082357_541079.exe
Analysis ID:	626599
MD5:	bef71f070519aad800bf09d7d5a7659b
SHA1:	2d276da3aefc56f4fa91cfaaf7e766f48f1d6140
SHA256:	969bf771ed84b11bc61cff977691a938687d043ca13b851efa7a627ef58b90b0
Tags:	AgentTeslaexegeoHalkbankTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected MSILDownloaderGeneric

Multi AV Scanner detection for dropped file

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Uses the Telegram API (likely for C&C communication)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Yara detected Generic Downloader

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

Halkbank_Ekstre_20220513_082357_541079.exe (PID: 6424 cmdline: "C:\Users\user\Desktop\Halkbank_Ekstre_20220513_082357_541079.exe" MD5: BEF71F070519AAD800BF09D7D5A7659B)

cmd.exe (PID: 5068 cmdline: "C:\Windows\System32\cmd.exe" /c timeout 20 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 1760 cmdline: timeout 20 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

InstallUtil.exe (PID: 1028 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)

Ffnbziuo.exe (PID: 4600 cmdline: "C:\Users\user\AppData\Roaming\Zsjnsslxj\Ffnbziuo.exe" MD5: BEF71F070519AAD800BF09D7D5A7659B)

cmd.exe (PID: 3356 cmdline: "C:\Windows\System32\cmd.exe" /c timeout 20 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 5816 cmdline: timeout 20 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

Ffnbziuo.exe (PID: 4568 cmdline: "C:\Users\user\AppData\Roaming\Zsjnsslxj\Ffnbziuo.exe" MD5: BEF71F070519AAD800BF09D7D5A7659B)

cmd.exe (PID: 1000 cmdline: "C:\Windows\System32\cmd.exe" /c timeout 20 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6180 cmdline: timeout 20 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot5351864471:AAGAqiOJqCiUj9zFIqSZeiHPgOb5cf2UkxY/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Chat id": "5388276304", "Chat URL": "https://api.telegram.org/bot5351864471:AAGAqiOJqCiUj9zFIqSZeiHPgOb5cf2UkxY/sendDocument"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Halkbank_Ekstre_20220513_082357_541079.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Zsjnsslxj\Ffnbziuo.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.399275119.000000000415D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.399275119.000000000415D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.545103234.000000000331D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.545103234.000000000331D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000002.527576945.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.527576945.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000000.386534863.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000000.386534863.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.548623792.0000000008269000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.548623792.0000000008269000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000000.386867081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000000.386867081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.398967629.00000000040E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.398967629.00000000040E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000000.386199386.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000000.386199386.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.545199356.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.545199356.00000000033AC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000000.385913370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000000.385913370.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000011.00000002.544867705.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.544867705.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.399607436.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.399607436.00000000041EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000002.529435822.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.529435822.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000F.00000002.529435822.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Halkbank_Ekstre_20220513_082357_541079.exe PID: 6424	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Halkbank_Ekstre_20220513_082357_541079.exe PID: 6424	JoeSecurity_MSIL_Downloader_Generic	Yara detected MSIL_Downloader_Generic	Joe Security
Process Memory Space: InstallUtil.exe PID: 1028	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: InstallUtil.exe PID: 1028	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 1028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ffnbziuo.exe PID: 4600	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Ffnbziuo.exe PID: 4600	JoeSecurity_MSIL_Downloader_Generic	Yara detected MSIL_Downloader_Generic	Joe Security
Process Memory Space: Ffnbziuo.exe PID: 4568	JoeSecurity_MSIL_Downloader_Generic	Yara detected MSIL_Downloader_Generic	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e23:$s10: logins 0x3088a:$s11: credential 0x2cd97:$g1: get_Clipboard 0x2cda5:$g2: get_Keyboard 0x2cdb2:$g3: get_Password 0x2e0d1:$g4: get_CtrlKeyDown 0x2e0e1:$g5: get_ShiftKeyDown 0x2e0f2:$g6: get_AltKeyDown
15.0.InstallUtil.exe.400000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.3.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.0.InstallUtil.exe.400000.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
0.0.Halkbank_Ekstre_20220513_082357_541079.exe.e00000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e23:$s10: logins 0x3088a:$s11: credential 0x2cd97:$g1: get_Clipboard 0x2cda5:$g2: get_Keyboard 0x2cdb2:$g3: get_Password 0x2e0d1:$g4: get_CtrlKeyDown 0x2e0e1:$g5: get_ShiftKeyDown 0x2e0f2:$g6: get_AltKeyDown
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.419c788.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
18.0.Ffnbziuo.exe.890000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
17.2.Ffnbziuo.exe.335c788.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.335c788.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.335c788.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e23:$s10: logins 0x3088a:$s11: credential 0x2cd97:$g1: get_Clipboard 0x2cda5:$g2: get_Keyboard 0x2cdb2:$g3: get_Password 0x2e0d1:$g4: get_CtrlKeyDown 0x2e0e1:$g5: get_ShiftKeyDown 0x2e0f2:$g6: get_AltKeyDown
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.e00000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
17.0.Ffnbziuo.exe.10000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.4174768.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.4174768.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.4174768.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x5ac43:$s10: logins 0x5a6aa:$s11: credential 0x56bb7:$g1: get_Clipboard 0x56bc5:$g2: get_Keyboard 0x56bd2:$g3: get_Password 0x57ef1:$g4: get_CtrlKeyDown 0x57f01:$g5: get_ShiftKeyDown 0x57f12:$g6: get_AltKeyDown
17.2.Ffnbziuo.exe.3334768.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.3334768.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.3334768.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x5ac43:$s10: logins 0x5a6aa:$s11: credential 0x56bb7:$g1: get_Clipboard 0x56bc5:$g2: get_Keyboard 0x56bd2:$g3: get_Password 0x57ef1:$g4: get_CtrlKeyDown 0x57f01:$g5: get_ShiftKeyDown 0x57f12:$g6: get_AltKeyDown
15.0.InstallUtil.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.0.InstallUtil.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
15.0.InstallUtil.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.1.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.0.InstallUtil.exe.400000.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
15.0.InstallUtil.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.2.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.0.InstallUtil.exe.400000.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
17.2.Ffnbziuo.exe.10000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
15.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
17.2.Ffnbziuo.exe.33ac7a8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.33ac7a8.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.33ac7a8.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e23:$s10: logins 0x3088a:$s11: credential 0x2cd97:$g1: get_Clipboard 0x2cda5:$g2: get_Keyboard 0x2cdb2:$g3: get_Password 0x2e0d1:$g4: get_CtrlKeyDown 0x2e0e1:$g5: get_ShiftKeyDown 0x2e0f2:$g6: get_AltKeyDown
18.2.Ffnbziuo.exe.890000.0.unpack	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x133f:$x1: https://cdn.discordapp.com/attachments/
17.2.Ffnbziuo.exe.33ac7a8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.33ac7a8.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.33ac7a8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.Ffnbziuo.exe.33ac7a8.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
17.2.Ffnbziuo.exe.335c788.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.335c788.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
17.2.Ffnbziuo.exe.335c788.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
17.2.Ffnbziuo.exe.335c788.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
15.0.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.0.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
15.0.InstallUtil.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Halkbank_Ekstre_20220513_082357_541079.exe.41ec7a8.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c23:$s10: logins 0x3268a:$s11: credential 0x2eb97:$g1: get_Clipboard 0x2eba5:$g2: get_Keyboard 0x2ebb2:$g3: get_Password 0x2fed1:$g4: get_CtrlKeyDown 0x2fee1:$g5: get_ShiftKeyDown 0x2fef2:$g6: get_AltKeyDown
Click to see the 59 entries

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Halkbank_Ekstre_20220513_082357_541079.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Halkbank_Ekstre_20220513_082357_541079.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Windows Analysis Report
Halkbank_Ekstre_20220513_082357_541079.exe