MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a
SHA3-384 hash: 2101b1899251a7c616368171f9acf3713c33a7a98d900ebf42ea92827b5a5f42af787eb319ee90e43c3f152152ee4d00
SHA1 hash: 348ae0904123a2194779115cbe7fba8d948289c5
MD5 hash: 2f9f89c14bb13bafd2f9b76550d4ba25
humanhash: enemy-hydrogen-kitten-sodium
File name:Factura de clients_0010002346.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:769'536 bytes
First seen:2020-10-16 10:23:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:qaBWvyPA5MfrJbmJM27FJhRjGMM5JXReoPPlQ7JFdOsVo67mtj9db91dtJ:RUvyPA5MsB7FJhRiFESWiumJnJ
Threatray 9'514 similar samples on MalwareBazaar
TLSH 63F4F16633A9DF64E13D677624B450A057F4B186D322DB0E3FA913CD2962F401B33B6A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: anacastillo.pw
Sending IP: 138.68.104.87
From: Administracion <info@anacastillo.pw>
Reply-To: duldi@duldi.com
Subject: Factura de Clients
Attachment: Factura de clients_0010002346.rar (contains "Factura de clients_0010002346.exe")

AgentTesla SMTP exfil server:
zip-creations.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71891/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493357
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 299127 Sample: Factura de clients_0010002346.exe Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 32 cdn.onenote.net 2->32 36 Found malware configuration 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 Sigma detected: Scheduled temp file as task from temp location 2->40 42 10 other signatures 2->42 8 Factura de clients_0010002346.exe 7 2->8         started        signatures3 process4 file5 24 C:\Users\user\AppData\Roaming\khyxHN.exe, PE32 8->24 dropped 26 C:\Users\user\...\khyxHN.exe:Zone.Identifier, ASCII 8->26 dropped 28 C:\Users\user\AppData\Local\...\tmp2530.tmp, XML 8->28 dropped 30 C:\...\Factura de clients_0010002346.exe.log, ASCII 8->30 dropped 44 Injects a PE file into a foreign processes 8->44 12 Factura de clients_0010002346.exe 2 8->12         started        16 schtasks.exe 1 8->16         started        18 Factura de clients_0010002346.exe 8->18         started        20 Factura de clients_0010002346.exe 8->20         started        signatures6 process7 dnsIp8 34 zip-creations.com 162.253.153.213, 49733, 587 REPRISE-HOSTINGUS United States 12->34 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->46 48 Tries to steal Mail credentials (via file access) 12->48 50 Tries to harvest and steal ftp login credentials 12->50 52 Tries to harvest and steal browser information (history, passwords, etc) 12->52 22 conhost.exe 16->22         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 17:35:09 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ar7qsv63yglzoz7deczpsfcj2indv624m44ghshnfdvnx6izkofa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06575f01727b5aa6296492bdbaae78073ee3b3abc8870b6b9027368260bc768e
AgentTesla
1d5510a568c0ae43bdd0b984e413878d2b72735ed605ec112026fc970f1a599f
AgentTesla
460a1e3acbde201bf39a076cc672dc052368cf55343fcbc6ad2a10ffb6fb3215
AgentTesla
65bdf218a95af52100c20e6f146a7acf16aa0ed0a34ddc7f4a68c66554b648da
AgentTesla
71f156f01f3722503ae7b346c37f64a6bc9efe810309636aa30673062b59aa6a
AgentTesla
84da474dc9a86be051d5a30bd2c4715026e0faab0daf2950fcbebb8e46f907ad
AgentTesla
902924b52c5bb0479fecdd9802b067aaa25f1cf89ac97c91abe6cbe59a2ba21c
AgentTesla
a5602ba2bfa6fcd7b914266f63da512b1c212c75406731aaefa9fcbcd785a57d
AgentTesla
a84cf81fa2d7790ea8f5d59354fa47d2067a12c89c2d975ee2f3b9547765be1e
AgentTesla
b48cfe64a7d020f64e9b09d7636b59ac1f567a51d246b8dd59c53eaa6b339aa7
AgentTesla
+ 9'504 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/201016-z1sbwg33w2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
205a1a34a179979c3f974335d3e3bbb8408031bea3fa0ffa64f69e56edf66926
MD5 hash:
d017a9cba84614e2263948f952625b31
SHA1 hash:
267bcc5bccfd0e41cc0a627a34d82684331f9b7e
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/bd234bb7-0cbf-4bc7-9a1d-ef1ae49f0978/
SH256 hash:
70a0c1625beae9d9e42ad9cfc143ddbf48a0bc5b9af5aa88ad9afcabe5f441f3
MD5 hash:
22c4a5edb899bbf5be12dbc9e06a57da
SHA1 hash:
5b34915e0935685d9b87b13edb89cc18c55e21d6
Link:
https://www.unpac.me/results/bd234bb7-0cbf-4bc7-9a1d-ef1ae49f0978/
SH256 hash:
f03b6b8e769a1030089c20e899ee96e0b8e8681af065d5e9fe959109d6d4ae18
MD5 hash:
326d200b7a3eb2b5583985e3a7cce0db
SHA1 hash:
65f4dc7d405e88ab21d81461b49faa1f8d9b7656
Link:
https://www.unpac.me/results/bd234bb7-0cbf-4bc7-9a1d-ef1ae49f0978/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/bd234bb7-0cbf-4bc7-9a1d-ef1ae49f0978/
SH256 hash:
047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a
MD5 hash:
2f9f89c14bb13bafd2f9b76550d4ba25
SHA1 hash:
348ae0904123a2194779115cbe7fba8d948289c5
Link:
https://www.unpac.me/results/bd234bb7-0cbf-4bc7-9a1d-ef1ae49f0978/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a0b1044ec1ccca560ea72d09ae16cfcf80c5a9eb5bfd74c0a9b89c7a0e63efa6

AgentTesla

Executable exe 047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a

(this sample)

  
Dropped by
MD5 7f7af1e796934a02ae1cf41f4b56448b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71891/
  
Dropped by
SHA256 a0b1044ec1ccca560ea72d09ae16cfcf80c5a9eb5bfd74c0a9b89c7a0e63efa6

Comments