MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e128c983b60048ebbd6cd52281431f2658fdf9ed7e79f9976a3ad882c822da7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e128c983b60048ebbd6cd52281431f2658fdf9ed7e79f9976a3ad882c822da7
SHA3-384 hash: 97b91267922f56aafd3b52470a691805d25a8cd94d7dff81b4ec35ff47a66c2dd591993d8b75a1ecf787c2a1c11a15cd
SHA1 hash: 62e4d91c85b245d3df9bae1545eb9c419abedb10
MD5 hash: 306d64b4f8a80d2953bd60aeaa9bab4c
humanhash: tango-august-nitrogen-steak
File name:Emirate bank TT copy 2020-09-20 at 07.30.55.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:181'896 bytes
First seen:2020-09-23 11:55:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:ev0ykKPTnk75/FNTdXZaSAnkxhqtOlvOj6+Gp5WDSuD646p:evNTnw9TFZmkxh4lmkDS
Threatray 86 similar samples on MalwareBazaar
TLSH 5404175DB26DC48DF4A60B386B35131715E939435AE1893939705BBF0B2DAC3CA0EBE1
Reporter tammeto
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/64831/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a window
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Setting a keyboard event handler
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/473275
Signature
Binary contains a suspicious time stamp
Contains functionality to hide a thread from the debugger
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Installs a global keyboard hook
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289081 Sample: Emirate bank TT copy  2020-... Startdate: 23/09/2020 Architecture: WINDOWS Score: 100 60 Found malware configuration 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected AgentTesla 2->64 66 6 other signatures 2->66 7 Emirate bank TT copy  2020-09-20 at 07.30.55.exe 15 2 2->7         started        11 ytElYM.exe 14 2 2->11         started        13 WerFault.exe 2->13         started        15 ytElYM.exe 2->15         started        process3 dnsIp4 54 paste.nrecom.net 7->54 56 server5.nrecom.net 37.120.174.218, 443, 49715, 49731 NETCUP-ASnetcupGmbHDE Germany 7->56 78 Hides threads from debuggers 7->78 17 Emirate bank TT copy  2020-09-20 at 07.30.55.exe 2 5 7->17         started        22 timeout.exe 1 7->22         started        24 Emirate bank TT copy  2020-09-20 at 07.30.55.exe 7->24         started        36 4 other processes 7->36 58 paste.nrecom.net 11->58 80 Multi AV Scanner detection for dropped file 11->80 82 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->82 84 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->84 26 ytElYM.exe 11->26         started        28 timeout.exe 1 11->28         started        30 WerFault.exe 11->30         started        86 Writes to foreign memory regions 13->86 32 Emirate bank TT copy  2020-09-20 at 07.30.55.exe 13->32 injected 34 timeout.exe 15->34         started        signatures5 process6 dnsIp7 48 mail.chinacbn.biz 198.54.126.106, 26, 49736 NAMECHEAP-NETUS United States 17->48 50 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.169.38, 443, 49735 AMAZON-AESUS United States 17->50 52 2 other IPs or domains 17->52 44 C:\Users\user\AppData\Local\...\ytElYM.exe, PE32 17->44 dropped 46 C:\Users\user\...\ytElYM.exe:Zone.Identifier, ASCII 17->46 dropped 68 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->68 70 Tries to steal Mail credentials (via file access) 17->70 72 Tries to harvest and steal ftp login credentials 17->72 76 2 other signatures 17->76 38 conhost.exe 22->38         started        74 Installs a global keyboard hook 26->74 40 conhost.exe 28->40         started        42 conhost.exe 34->42         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e128c983b60048ebbd6cd52281431f2658fdf9ed7e79f9976a3ad882c822da7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-22 16:41:17 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=byjizgb3maci5o6wzvjcqfbr6jsy7x4627tz7glwuowyqlecfwtq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01dba88e6444acb9df2aac52afd7819f95b84144e209b925c62eb78a3bdca378
AgentTesla
0b1453de5134635dc69e8359da060210c55e2af6c875497512db6332486e3ea0
AgentTesla
19b7ae6956a38825ac143952843f6e046c642a9dc635e18d4f84dcff4568c142
AgentTesla
2f3474e57e4d3df1cedeef87e3716fa9143a63cf7ffdd9273273f41c8a8bc223
AgentTesla
3c359f5677b780cc968723ceca8310ed20ae4bf691bd9900c7d334303b101776
AgentTesla
614052880e43375009bd02fcb10e8399d2e855cff58fc27ad94711dee1973186
AgentTesla
7301fa4edc89a5bd4a18479ebf5b88460ee35b4631e147a8754866a58bcae873
AgentTesla
c1c58c6918062b4e641a924b19712a015d1a74b184e3fb19e444216edbdfcedd
AgentTesla
c9692914eb11d2c1cfb26bae5877943c1769994f857f0aa85b8c8f5064a2f042
AgentTesla
d98f8380522e71c61b91d1fbdf98c0528fc20388a85695529824754f00a183a1
AgentTesla
dc4eaa151b01375e0ba2392396b60e6abebab99e5590c93ab23ee3063aba5eb5
AgentTesla
fd427caee9d158cc48ba9b5a0ecd3243a77b354f07321a5f80e5fdcde17aed9f
AgentTesla
+ 76 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
persistence spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200923-gs4be2k5b2/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e128c983b60048ebbd6cd52281431f2658fdf9ed7e79f9976a3ad882c822da7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 0e128c983b60048ebbd6cd52281431f2658fdf9ed7e79f9976a3ad882c822da7

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/64831/

Comments