MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def
SHA3-384 hash: cd1c658b6b9afe9af3bbdd0bb3032e9d7490635efea42a37662165a428a05062cbc714f6b8b85cbbb6a442c11d3b8d5d
SHA1 hash: 7566d86a447176a6a73ec6603df6a987da8681b1
MD5 hash: d1a4c4d05ecd22dc4911c2d2a95a4e05
humanhash: lactose-xray-delaware-bacon
File name:Outstanding Statement-0413.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:819'712 bytes
First seen:2021-04-20 20:18:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:4xKR3rBLOLplL7aNssXhdKtgSjLjERYgB/B:KSrIFlHKsq6tdzERYgB/B
Threatray 4'093 similar samples on MalwareBazaar
TLSH 5D050135569CFB89C02E2776E860053107B3A263F366CB5FE88C51985E25782F87C79B
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/140404/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.658-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-20 06:35:40 UTC
AV detection:
34 of 47 (72.34%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdfktl4lypls7r3isywcggnynslrfisdpzwkbz6mvd6basktnxxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
102b0bdae4e027e3e115490a1fe904b1a9f4fd9e4e52243719ee1167ec4ed62a
AgentTesla
3ee4e620dd7cb6d8a6f604e5653a4f5cbf1258032ffc7d13ae9a415c672a5713
AgentTesla
5defd50046db301c82c85cc8306960982f576cbf5446f24062cc570dcf0becec
AgentTesla
69f4101e63fdfdec4a5b6fc4a778619a69f9511416dd90fe9df33502ff8d9d4f
AgentTesla
790b008421852f555794a5e59c91f894993dcac641104ca06087bda8c1b5ea50
AgentTesla
8d10af8f247bb74f1a3d0878785f3afa173c82d4c881f29dd5b60ea6ed5f6b90
AgentTesla
a9837c36763da6705fe6ad7293465230a14aa33c935b08bc88268ff9d06cc7ec
AgentTesla
b8b373ce2f5835b617f904b50e5e594232982967ea1a12b35bd085c83aa057bb
AgentTesla
b8e4c54f15ac8fc84223e2460f6201401c960851b4006d61360caa57c34af3ed
AgentTesla
d375f6f780b9623c85714c9fadae46359a8e308bdeaee7e2161a86c0a89c7d06
AgentTesla
+ 4'083 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210420-1kj7la8ltn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302

AgentTesla

Executable exe 08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def

(this sample)

  
Dropped by
MD5 92b3592c5d8d1637aa36701a52ed60a1
  
Dropped by
SHA256 4a6f5cd0562d515f27aace0fa5029f6408d6f712c627404df22bf34dc3408302
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/140404/

Comments