MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c
SHA3-384 hash: df0b7da8cda9844030c06475d787f43994a1208f0420d5641bba10dcfc1c5e4a3204110f3276dcbe95bae789aedb680c
SHA1 hash: ef8cdcd9fba69349d4ab741ddc3e75511edd207f
MD5 hash: 237fad6487ed1822df06eb87b2454a54
humanhash: violet-bulldog-pennsylvania-mobile
File name:CI-210403L.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:714'752 bytes
First seen:2021-04-04 15:10:37 UTC
Last seen:2021-04-04 15:15:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:79LYgFREEWZa5cCadTNZ4SYUP71kFHMWBPLLgzkpV4b6QayXses6SMmi/Zi1C/O:79L9EEWEeCaN4SDT1kFHMY8YbpJTR6SC
Threatray 3'670 similar samples on MalwareBazaar
TLSH A0E4CF6233689F9AF43EE3B9A4245104D7F3E80BE731DA9D7EA010DD1931F848766E52
Reporter cocaman
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CI-210403L.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-04 15:14:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bf8c866b-e1c0-4995-9e8a-759485f6b9e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132101/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.623-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dd60b2c5-a19d-4045-ae36-171b25e90927
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/665613
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 381734 Sample: CI-210403L.exe Startdate: 04/04/2021 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Found malware configuration 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 5 other signatures 2->55 6 CI-210403L.exe 3 2->6         started        10 zUbDt.exe 3 2->10         started        12 zUbDt.exe 2 2->12         started        process3 file4 33 C:\Users\user\AppData\...\CI-210403L.exe.log, ASCII 6->33 dropped 57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->57 59 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->59 61 Injects a PE file into a foreign processes 6->61 14 CI-210403L.exe 2 9 6->14         started        19 CI-210403L.exe 6->19         started        21 CI-210403L.exe 6->21         started        63 Multi AV Scanner detection for dropped file 10->63 65 Machine Learning detection for dropped file 10->65 23 zUbDt.exe 2 10->23         started        25 zUbDt.exe 10->25         started        27 zUbDt.exe 10->27         started        31 2 other processes 10->31 29 zUbDt.exe 2 12->29         started        signatures5 process6 dnsIp7 39 mail.prinutrition.com 192.254.180.165, 49773, 49774, 587 UNIFIEDLAYER-AS-1US United States 14->39 35 C:\Users\user\AppData\Roaming\...\zUbDt.exe, PE32 14->35 dropped 37 C:\Users\user\...\zUbDt.exe:Zone.Identifier, ASCII 14->37 dropped 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->41 43 Tries to steal Mail credentials (via file access) 14->43 45 Tries to harvest and steal ftp login credentials 14->45 47 3 other signatures 14->47 file8 signatures9
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-03 02:49:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
47
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbzkdpqnwdo6vmgj2tks2rl5o322bibchg56ggec4xlusoxztewa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06b4de3d0ea9895ad2d5d1139d3fbc9a671890e8a66c3b7607351ac10fa30562
AgentTesla
2ae87737bdf6530806f51a691b52efa8919e48d84a49ee756f356bf4556a38e5
AgentTesla
6995fbe6e27b74546ac4ab82c7b00fe00884209e62d2b689b9ff3826752ca20e
AgentTesla
6ac20017a19271d64ea0f7dee1436dff9251a385b1a5b3ad9edac831563665ec
AgentTesla
965504bff8dbe047149efa3e661d859d87b543774f5d0d25a19219dc9be40cc5
AgentTesla
cd54e4b043619a391ad6cd9fa99e7c22e8d7321d9a98d1fa3b7ea8526cb688ab
AgentTesla
cfe1f69c2984de3f5d476db3ce45aa4d95a8137f0ff1ba07c1b0cecf15075c93
AgentTesla
d9cedebf76480c48b17ab650c102473a80ec6a9525ef0ae2f827ef567f914aff
AgentTesla
e7ccbe9dfaa198263b85336d9f89a775f7601070708ce65b9e4612332e0207b8
AgentTesla
ead0f6ef88c149f4318129ed6e3ef5fb30bd2ab03afef3625ca08d1b2f6f180e
AgentTesla
+ 3'660 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210404-9m9brvf4gs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6590b9ec4fa84e44c372fda26f47d6d58859d74869621c6bdd4086e6ae411379
MD5 hash:
95dfa1a9015a17a1d49b4faa3f3d999d
SHA1 hash:
427b72727b28436554d0443d797f19b2ea37cc16
Link:
https://www.unpac.me/results/104cd344-4ff2-4716-b1ed-c96bbf5b1281/
SH256 hash:
0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c
MD5 hash:
237fad6487ed1822df06eb87b2454a54
SHA1 hash:
ef8cdcd9fba69349d4ab741ddc3e75511edd207f
Link:
https://www.unpac.me/results/104cd344-4ff2-4716-b1ed-c96bbf5b1281/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 87cf17675abb073ea19c12371f4c5cc65ce697e71699365a0ade1bd061189974

AgentTesla

Executable exe 0872a1be0db0ddeab0c9d4d52d457d76f5a0a02239bbe31882e5d7493af9992c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 87cf17675abb073ea19c12371f4c5cc65ce697e71699365a0ade1bd061189974
Cape
Cape
https://www.capesandbox.com/analysis/132101/
  
Dropped by
SHA256 07bc3536fcffde5f8ea6064d1ac2c8807de0e280247b0432b67dab965ea0a49d

Comments