MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03d0c28c82537bc47e03f83532cdfd576b1524451a4dc7ea69f150b30cfaf65e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03d0c28c82537bc47e03f83532cdfd576b1524451a4dc7ea69f150b30cfaf65e
SHA3-384 hash: 65cd208e5f7c0798ceccf03ca16a598b2f7be747d03c737de06235758c9f2e5f4d37a0680483d8e3bd79e326dc0bb6cb
SHA1 hash: cddef66035b1230850f40cc3d989b9e7693cd80c
MD5 hash: 9d3aa67b04af92698f51bcfb156197e3
humanhash: whiskey-uncle-ink-charlie
File name:PI.479363_003.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:577'024 bytes
First seen:2021-05-10 10:37:19 UTC
Last seen:2021-05-10 11:01:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:3Ptu98gi9I6izNzbyb9e4G6oMDO6f7DHcgm+MeeqR:3MS9bizxYvyMDO6f77cgm+V1
Threatray 4'686 similar samples on MalwareBazaar
TLSH 21C401B457485F2BC27E18BC208022C153F9E1326E53E78D5EE844BD62633EE4A716DB
Reporter TeamDreier
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/153925/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/777263
Signature
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 409659 Sample: PI.479363_003.exe Startdate: 10/05/2021 Architecture: WINDOWS Score: 100 55 medicalperu.com 2->55 57 mail.medicalperu.com 2->57 67 Found malware configuration 2->67 69 Multi AV Scanner detection for dropped file 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 4 other signatures 2->73 8 PI.479363_003.exe 7 2->8         started        12 kprUEGC.exe 5 2->12         started        14 kprUEGC.exe 4 2->14         started        signatures3 process4 file5 43 C:\Users\user\AppData\Roaming\hstKARR.exe, PE32 8->43 dropped 45 C:\Users\user\AppData\Local\...\tmp8206.tmp, XML 8->45 dropped 47 C:\Users\user\...\PI.479363_003.exe.log, ASCII 8->47 dropped 75 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->75 77 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->77 79 Contains functionality to register a low level keyboard hook 8->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 8->81 16 PI.479363_003.exe 2 5 8->16         started        21 schtasks.exe 1 8->21         started        83 Multi AV Scanner detection for dropped file 12->83 85 Injects a PE file into a foreign processes 12->85 23 schtasks.exe 1 12->23         started        25 kprUEGC.exe 2 12->25         started        27 kprUEGC.exe 14->27         started        29 schtasks.exe 14->29         started        signatures6 process7 dnsIp8 49 medicalperu.com 66.225.201.69, 49766, 49767, 49768 SERVERCENTRALUS United States 16->49 51 mail.medicalperu.com 16->51 53 192.168.2.1 unknown unknown 16->53 37 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 16->37 dropped 39 C:\Users\user\...\kprUEGC.exe:Zone.Identifier, ASCII 16->39 dropped 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->59 61 Tries to steal Mail credentials (via file access) 16->61 63 Tries to harvest and steal ftp login credentials 16->63 65 4 other signatures 16->65 31 conhost.exe 21->31         started        33 conhost.exe 23->33         started        41 C:\Windows\System32\drivers\etc\hosts, ASCII 27->41 dropped 35 conhost.exe 29->35         started        file9 signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/03d0c28c82537bc47e03f83532cdfd576b1524451a4dc7ea69f150b30cfaf65e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-07 22:36:49 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3cb53846ce84b84a3c38a4b4e542fd08b30be6c160e2594b9e6e01752bd0a043
AgentTesla
8948b3f93b1fe502e9b838271ac7e46f15e5a79ea0706a7834cedcbd0c10b7d9
AgentTesla
a2f1773e4b9146563dbf711ca1462448a7a847f8b6660424f72faaa5fa9b20d4
AgentTesla
a89fb0409ae1c4b7693d58b270738a2e36d0e2f5b099550fe27353876cba6b6b
AgentTesla
abe6a77fefdede7de287d151689f87a3f59eb496d94351f4085b3bc1a6b755c2
AgentTesla
c8b1422e0faff76b67b7cdfe2e9be0ba799522e729aba5cd191b1809740a7fd1
AgentTesla
d174e57a97b4bccb71d49b9f9005940829c6ed542e3cc534cd13dd8568fb28f4
AgentTesla
da292ea9e3cda3911d3e6023e9ead0e663a14a1d089cabe7830d46f9c27caeaa
AgentTesla
e07ba21e5d098a88ce3e45d9ed869b30726c31bd13b6a88205a80265a45f605c
AgentTesla
e99bae3896aa527b7e77c3ecda493364d913cfa2ddf1ef0b1a072d9f4289764f
AgentTesla
+ 4'676 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210510-kfv4rkkckx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03d0c28c82537bc47e03f83532cdfd576b1524451a4dc7ea69f150b30cfaf65e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/153925/

Comments