MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00
SHA3-384 hash: 1bbd9d11dced22cddc40840a55eb75b6311d1fd067e63806bdde086caeedabe736f18ea9e5f2264a4f54cd31feb536b1
SHA1 hash: dfa94bbe835439beabe8ba7ca6d90712326dc087
MD5 hash: 1686f2ca568d14d7f2b177ee1c743f60
humanhash: salami-delaware-high-stream
File name:1686f2ca568d14d7f2b177ee1c743f60.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'632 bytes
First seen:2021-10-11 13:59:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:Il4mUf/JE8lFtoPT1+dsQGVW6GH0KAhv:FmUft2PT1+dsQlJ6
Threatray 11'932 similar samples on MalwareBazaar
TLSH T1EDD4B02039FE515AF272AF766ED1B6599F6FBEB26603C00D1091734B0632A81CDE153B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ-117404.doc
Verdict:
Malicious activity
Analysis date:
2021-10-11 10:17:04 UTC
Tags:
exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/559ae045-dddd-40e9-bda6-cee3821e2d18

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196652/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25-2.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6164436bfd35fe780c382222/reports/e948232f-86d6-4521-b02e-ee0c8de9b812/overview
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f60c2c8f-b98f-4158-9c66-f2d9c3bc8011
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/867869
Signature
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 500297 Sample: aQ7G4P3lIS.exe Startdate: 11/10/2021 Architecture: WINDOWS Score: 100 30 smtp.yandex.ru 2->30 32 smtp.yandex.com 2->32 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected AgentTesla 2->50 52 2 other signatures 2->52 7 aQ7G4P3lIS.exe 3 2->7         started        11 word.exe 3 2->11         started        13 word.exe 2 2->13         started        signatures3 process4 file5 28 C:\Users\user\AppData\...\aQ7G4P3lIS.exe.log, ASCII 7->28 dropped 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->54 56 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->56 15 aQ7G4P3lIS.exe 2 5 7->15         started        58 Multi AV Scanner detection for dropped file 11->58 20 word.exe 2 11->20         started        60 Injects a PE file into a foreign processes 13->60 22 word.exe 2 13->22         started        signatures6 process7 dnsIp8 34 smtp.yandex.ru 15->34 36 smtp.yandex.com 15->36 24 C:\Users\user\AppData\Roaming\word\word.exe, PE32 15->24 dropped 26 C:\Users\user\...\word.exe:Zone.Identifier, ASCII 15->26 dropped 38 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->38 40 Tries to steal Mail credentials (via file access) 15->40 42 Tries to harvest and steal ftp login credentials 15->42 44 2 other signatures 15->44 file9 signatures10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 10:34:38 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aubz5fy3o2hfglw7vb3xuxjqbdbr2csi3ku7cq6jt5mvr2ianmaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2bed744d28b0e98b998ee08a830c52655037ca72f311159c7125ad123369f006
AgentTesla
3c42ad47ce02dd4dc002eba2fd6714df6b0dbdf78d2c300433acc430942f0aa5
AgentTesla
4ba9d847f598add124d3b14f48d847665891fd6ec817e8f09bdf87dbb83acb0f
AgentTesla
b383a9462220caadad44787b626a17e201471a2ca3283e9cfa1cbdcbc974f501
AgentTesla
be446de6d1c5ea29642e98a11cf7ad2b9fc64d2dbca79f499c56b81257ba7ced
AgentTesla
cb6657e643921d36fb24eed7ae829888e685ac883e1798ae016f9c39dad99490
AgentTesla
fe8b552d0266feb1b3ef94bb39209fc1253295865d8f49a2f6cb6a3f68271c7c
AgentTesla
+ 11'922 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211011-ra1wnshdd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d434e7cb4105d7e760a39a1a8a1306338b00fbd6507025d53e4c44ede73d3788
MD5 hash:
6613b992e916924c3f38a179bb9866ab
SHA1 hash:
cd5741f4d0a4685c5fd9c9e2e708bbf33ec1691a
Link:
https://www.unpac.me/results/a719fcfa-6e9d-4b71-9a2f-fcd2e1bccf6b/
SH256 hash:
2925ec83e51c772b8522264037a9acdcc5e32fe96620a0714c3d1b19b5e121e8
MD5 hash:
de7c90e3b5aeb782be2e1f38a0099027
SHA1 hash:
ab6a05a5d697034ad7e38910b2c34ee31b0422ea
Link:
https://www.unpac.me/results/a719fcfa-6e9d-4b71-9a2f-fcd2e1bccf6b/
SH256 hash:
563c687c3edae461fc16aee928e5288367864782d21f7b6fb4f4220e34dea721
MD5 hash:
44c9b40f20e1b7548a962fcaff3caebe
SHA1 hash:
1227457d29d1ddc1d8f56a329a12362e96802e64
Link:
https://www.unpac.me/results/a719fcfa-6e9d-4b71-9a2f-fcd2e1bccf6b/
SH256 hash:
05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00
MD5 hash:
1686f2ca568d14d7f2b177ee1c743f60
SHA1 hash:
dfa94bbe835439beabe8ba7ca6d90712326dc087
Link:
https://www.unpac.me/results/a719fcfa-6e9d-4b71-9a2f-fcd2e1bccf6b/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/05039e971b76/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 05039e971b768e532edfa8777a5d3008c31d0a48daa9f143c99f5958e9006b00

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1666460/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196652/

Comments