MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 080f9972ebfb306946e213424ef0970affd55dc8625bb4a2f3d3e38d2a6e2d72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | 080f9972ebfb306946e213424ef0970affd55dc8625bb4a2f3d3e38d2a6e2d72 |
|---|---|
| SHA3-384 hash: | ae14f8d57bbd549dd426df6b6e8e190dc9b4d0e95cdde7755969857c0a662db55a10661620efbbb6894d7df7e01fd628 |
| SHA1 hash: | 5c31ac9aa255c7a7c075220b13b38e707b57193c |
| MD5 hash: | 993531f20c91433b76a32434c02f339f |
| humanhash: | orange-summer-mockingbird-golf |
| File name: | AP #DBL 18192020-reg_01.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'459'712 bytes |
| First seen: | 2020-10-19 06:38:45 UTC |
| Last seen: | 2020-10-19 08:24:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger) |
| ssdeep | 24576:G/ynwxEHLJyUc4YTNc0NQFqQdD+YTG0vNxJIeKW9dDXraPd87OzdtXsH18s/:GmXrJyprTNc0NQga+2LPKWPjAd87Ozd2 |
| Threatray | 17 similar samples on MalwareBazaar |
| TLSH | A265223CD6E7EEC9C7FEC7B625FD2041DA9B84D26481E7568D4A797021277A088031BE |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe Telegram |
abuse_ch
Malspam distributing unidentified malware:HELO: mail.pistlewater.pw
Sending IP: 131.153.18.82
From: Bijith Nair <pistle@pistlewater.pw>
Subject: Fwd: TOP URGENT! - BL Draft Copy
Attachment: AP DBL 18192020-reg_01.gz (contains "AP #DBL 18192020-reg_01.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Running batch commands
Using the Windows Management Instrumentation requests
Creating a file
Creating a window
Creating a process from a recently created file
Reading critical registry keys
Launching the process to change network settings
Delayed writing of the file
DNS request
Sending an HTTP GET request
Deleting a recently created file
Sending a custom TCP request
Creating a file in the %temp% directory
Launching a process
Creating a file in the %AppData% subdirectories
Creating a process with a hidden window
Changing the Windows explorer settings
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Changing the Windows explorer settings to hide files extension
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Unauthorized injection to a recently created process
Stealing user critical data
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Result
Threat name:
Osno
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to hide user accounts
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: Capture Wi-Fi password
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal WLAN passwords
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected Osno Ransomware
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Backdoor.Androm
Status:
Malicious
First seen:
2020-10-18 21:21:51 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 7 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
keylogger stealer persistence spyware trojan family:agenttesla evasion
Behaviour
Enumerates processes with tasklist
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Executes dropped EXE
AgentTesla Payload
AgentTesla
Modifies visibility of file extensions in Explorer
Unpacked files
SH256 hash:
2758ec4bd97b7ba91d58821acb08e78c346421168456cddab86df212568b6e6e
MD5 hash:
f3323ccbb032cfe7828a00648f9f1964
SHA1 hash:
7133fa5ba74c20733bcd6a7da2fe394dee52077e
SH256 hash:
2cc442f7db3cf19c78d143b2ea017fc2e258e3660eb1bf14627d4a04a155e1a4
MD5 hash:
073eadcf98e663bab9596638b643ac73
SHA1 hash:
88a3e4308afc109d6605ac17870938c39bf612ae
SH256 hash:
f4ef231870e1909cdc5a39a7c717f8cfb7387c7bbb17165f3bbb729ff079a695
MD5 hash:
8a9707e0ad1440e452dd2aff4971a839
SHA1 hash:
921d901d195e2ea38d3e5cf5a8bf8177b99c09f4
SH256 hash:
4d6aeb22d0b3a140468c4645b767af97bb33e85244ef742219e40d7de6d8618b
MD5 hash:
9af533e1fe4f413bbdf6584cddf441e8
SHA1 hash:
ab12cd39ba246310de379d60b523c0c39b31c9b3
SH256 hash:
e3f9ac02690808ee8e82aeb07cb5c2a5bea0ec6b704f12749e6e1de14b996b55
MD5 hash:
80a1256052a8c22d8417f99945170b82
SHA1 hash:
d9a167b2a7e3611717b00a037686203935900297
SH256 hash:
080f9972ebfb306946e213424ef0970affd55dc8625bb4a2f3d3e38d2a6e2d72
MD5 hash:
993531f20c91433b76a32434c02f339f
SHA1 hash:
5c31ac9aa255c7a7c075220b13b38e707b57193c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.