MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9
SHA3-384 hash: 8ef6da5a36732f95cb3ca2f9e0d8122bc98aa1f2a8a17bca1efe3252d2d7b6d7305fa68ccdb50853ade5ae14d5322d29
SHA1 hash: 1ff3c6fd95f77440fbeaad12915972a65dd62878
MD5 hash: 69bc58fc2b4b03b0eeaa52a2b2fa57a8
humanhash: football-helium-beryllium-quiet
File name:SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'113'088 bytes
First seen:2021-12-07 17:26:26 UTC
Last seen:2021-12-07 21:19:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:NEWBcaZ/hhUNjizkHiKT63B0yJnJHRqlUpJDsH/oKqbG:CWuWh6NZCw63BtJJHRql+m/DqbG
Threatray 13'353 similar samples on MalwareBazaar
TLSH T10D35127C375366CDC0619636733B906816BA3D36A467C75EE88A324F4823B42B97335B
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.exe
Verdict:
Malicious activity
Analysis date:
2021-12-07 17:33:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ffe332e8-4027-4574-9a44-5da59eac1c08

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/212241/
Detection(s):
SecuriteInfo.com.MSIL.Packed.19.31373.22014.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Link:
https://www.filescan.io/uploads/61af996847ed217c0134cd70/reports/f5684254-d2ee-4409-9e01-f942ae29d9e4/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5dd3b088-1c98-4c5e-87da-3a4ed50fa24c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/903302
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 535777 Sample: SOA.exe Startdate: 07/12/2021 Architecture: WINDOWS Score: 100 29 mail.demo.jeninfo.com 2->29 31 demo.jeninfo.com 2->31 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 6 other signatures 2->47 7 SOA.exe 3 2->7         started        11 tKZVPq.exe 3 2->11         started        13 tKZVPq.exe 2 2->13         started        signatures3 process4 file5 21 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 7->21 dropped 49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->51 15 SOA.exe 2 5 7->15         started        53 Multi AV Scanner detection for dropped file 11->53 55 Machine Learning detection for dropped file 11->55 19 tKZVPq.exe 2 11->19         started        signatures6 process7 file8 23 C:\Users\user\AppData\Roaming\...\tKZVPq.exe, PE32 15->23 dropped 25 C:\Windows\System32\drivers\etc\hosts, ASCII 15->25 dropped 27 C:\Users\user\...\tKZVPq.exe:Zone.Identifier, ASCII 15->27 dropped 33 Tries to steal Mail credentials (via file / registry access) 15->33 35 Tries to harvest and steal browser information (history, passwords, etc) 15->35 37 Modifies the hosts file 15->37 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->39 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-07 17:27:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bf2nf5p7bxhszzakdrrexrgfq25oy25ggz6326bpqyv4ygfnqxeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
149ebb356a2e08ec3894093087e9cd746eab8ac26577beb15a0275c8e0c13493
AgentTesla
27ff4d7994a19e27c347e7794e0e48fa5c66f36e4f27ab407f9044494dd8c5a5
AgentTesla
284a7b827997880f862d34ae032872879702666ede431949cd345bc13544772c
AgentTesla
3c1f525cc5b9c4b3813a01e008640ed40145cc00eb54e123d9b6f10c9425c655
AgentTesla
6f871f3642191d04e4fe20f022f738d89b3ad90b531cef6adde91d10f257431d
AgentTesla
7fb4a26d9f2c3a08c69d7f5838b7f88d8c6f31ab2aa69b130b150449baaea7ad
AgentTesla
be8a12f170e03547cd3ed2300e61f226ea4e94b7eed1c6845f7cc68ac6947d2d
AgentTesla
+ 13'343 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211207-v1emxabfem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
47860779d436fc44096918af0633d3d7908838b13e92572b5a8a0417df6f2e5b
MD5 hash:
44d4728ce96ec090e7ed11fa334318a2
SHA1 hash:
a66c07407ef97467d34b4e612dd77468d550e2a1
Link:
https://www.unpac.me/results/47e0b926-0303-4eae-9181-da5c3a9840ce/
SH256 hash:
80855df0d7e7629d1f16cfecb7270f7db3ae6c1e32973803330862e531e69a53
MD5 hash:
2ee37952c40f8681eb58af6196d117da
SHA1 hash:
10f1c59089e1485b1440a47fbde89172dd000a29
Link:
https://www.unpac.me/results/47e0b926-0303-4eae-9181-da5c3a9840ce/
SH256 hash:
b75ec5e79a2950e55aa7849e13404e8c9306256e6b9355089da890e6b6e14996
MD5 hash:
d6b3f5aab08853bead8975532594a6d7
SHA1 hash:
040aa10a04d0223b4593e133b8904b5fe9fbe83c
Link:
https://www.unpac.me/results/47e0b926-0303-4eae-9181-da5c3a9840ce/
SH256 hash:
0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9
MD5 hash:
69bc58fc2b4b03b0eeaa52a2b2fa57a8
SHA1 hash:
1ff3c6fd95f77440fbeaad12915972a65dd62878
Link:
https://www.unpac.me/results/47e0b926-0303-4eae-9181-da5c3a9840ce/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0974d2f5ff0d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 0974d2f5ff0dcf2ce40a1c624bc4c586baec6ba6367dbd782f862bcc18ad85c9

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/212241/

Comments