MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c
SHA3-384 hash: c53fbeeda89f07cab000f0862024f432631e3ef7c574aaef78153fe829a6b1907becb0844ddc672af58a0e0b3e73ca11
SHA1 hash: 6dd0ca095e4043756c9f865180f76a4134e6899c
MD5 hash: 87c5e90dbcb885502ad60b5a40a87154
humanhash: ceiling-failed-mobile-carpet
File name:ORIGINAL.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:562'176 bytes
First seen:2020-08-20 17:20:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:Dkh8KirVcrI73IaXMI4YBIlvuCC3NRi1U+ygwUVXSGlPNR:tpn73IacI0huHNUGgwU4QNR
Threatray 10'638 similar samples on MalwareBazaar
TLSH 3BC412BD82997A0BD13C48B84102628567F6E1237027F74AFDD460F979CA3D9D7824EB
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/49239/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/442149
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 273673 Sample: ORIGINAL.EXE Startdate: 22/08/2020 Architecture: WINDOWS Score: 100 33 Found malware configuration 2->33 35 Multi AV Scanner detection for dropped file 2->35 37 Sigma detected: Scheduled temp file as task from temp location 2->37 39 8 other signatures 2->39 7 ORIGINAL.EXE 7 2->7         started        process3 file4 19 C:\Users\user\AppData\...\ANCAdIHKxtQnV.exe, PE32 7->19 dropped 21 C:\...\ANCAdIHKxtQnV.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp8F65.tmp, XML 7->23 dropped 25 C:\Users\user\AppData\...\ORIGINAL.EXE.log, ASCII 7->25 dropped 41 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->41 43 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->43 45 Injects a PE file into a foreign processes 7->45 11 ORIGINAL.EXE 4 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 ZRH-efz.ms-acdc.office.com 52.97.186.114, 49743, 587 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 11->27 29 192.168.2.1 unknown unknown 11->29 31 3 other IPs or domains 11->31 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->47 49 Tries to steal Mail credentials (via file access) 11->49 51 Tries to harvest and steal ftp login credentials 11->51 53 2 other signatures 11->53 17 conhost.exe 15->17         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 17:04:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oysp3kbcqvg4tccglufzi5ymgyeockmvmnvdz36tajhhxwb3fega._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0d2cb4e88c54f23cddb531a4c91a230cbc6e7c56e41536b9bcc9752a1185f8e9
AgentTesla
0ef7c8a77977cad0c01973b63c83892ff04d3da86ecf5e6bf1f2427361923864
AgentTesla
0feda673e5c76e32c520d867d3dfcac575f577188ccb49bb22df8fbc6a930ee5
AgentTesla
78a4165991c5ac4820cd119040a7ed548138bb532376e7be88c6813b3ef027ad
AgentTesla
82b85d6bc294eede14336f077f56aee1bd902c4ab91b7d37a8d0cf1fe11095fc
AgentTesla
85d34a30b3163b6db32ec267c22e5fd5cbfab30533aa4a829f9d79ca55e779d2
AgentTesla
ad7db1393e62d89dcb0039aa5ba64a897e88d3f6b76d146ccf419e952e57c317
AgentTesla
b3cbf1f12ae225e86e853b5a9c100248eac70557eaffff26020cdc9d165f3ff9
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
f8e79509055e8e73a467ac3fc37c303ce1968417c0d4cc76df99af32cf692f02
AgentTesla
+ 10'628 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200820-x4nmljqbax/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c

AgentTesla

Executable exe 7624fda822854dc988465d0b94770c3608e12995636a3cefd3024e7bd83b290c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 666aa117c9bd01a95cd23483dbf63f7fe57f744a479e0670b4d847853141270c
Cape
Cape
https://www.capesandbox.com/analysis/49239/

Comments