MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e1c451d08aec80a5064e6b93aa89ca1955dcf120dd81f1114d065203a6afabb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e1c451d08aec80a5064e6b93aa89ca1955dcf120dd81f1114d065203a6afabb
SHA3-384 hash: 4f945e9e25addfc24935191a6de2b082440c783fa9f4292e88ac9979c80d28184dd4e99460549ad4a7472971c3d42961
SHA1 hash: 3c8df750fd6ef891b2748e18312767208780a781
MD5 hash: 954d0c04696cc51fc9c2d3473b7663f4
humanhash: cup-shade-solar-mockingbird
File name:2WQEQQSAQ0.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:275'744 bytes
First seen:2021-03-11 11:29:39 UTC
Last seen:2021-03-11 13:38:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:rPKyLLaoh+4NnBl/++mzgMumkcUWz9zGj27fpymVfhgU6Cb:mtoh+4VG+KEmkAS2FvVZgUf
Threatray 3'181 similar samples on MalwareBazaar
TLSH 6F44235251F08CAFD59B9B392B9BAB3ED239D116464062C39BEB3E342C2F1579F15043
Reporter Anonymous
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2WQEQQSAQ0.exe
Verdict:
Malicious activity
Analysis date:
2021-03-11 11:25:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a288fb67-b6ff-4b0e-bbbd-476911fcd596

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/123783/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.18580.8094.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Launching a process
Creating a window
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/636753
Signature
.NET source code contains very large array initializations
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 367353 Sample: 2WQEQQSAQ0.exe Startdate: 11/03/2021 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Multi AV Scanner detection for dropped file 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 5 other signatures 2->38 6 ruffsea.exe 11 2->6         started        10 2WQEQQSAQ0.exe 1 13 2->10         started        12 ruffsea.exe 11 2->12         started        process3 file4 22 C:\Users\user\AppData\Local\...\d4xunlk.dll, PE32 6->22 dropped 40 Writes to foreign memory regions 6->40 42 Maps a DLL or memory area into another process 6->42 14 MSBuild.exe 8 6->14         started        24 C:\Users\user\AppData\Roaming\...\ruffsea.exe, PE32 10->24 dropped 26 C:\Users\user\AppData\Local\...\d4xunlk.dll, PE32 10->26 dropped 18 MSBuild.exe 4 10->18         started        28 C:\Users\user\AppData\Local\...\d4xunlk.dll, PE32 12->28 dropped 44 Multi AV Scanner detection for dropped file 12->44 46 Machine Learning detection for dropped file 12->46 20 MSBuild.exe 4 12->20         started        signatures5 process6 dnsIp7 30 smtp.ionos.com 74.208.5.2, 49738, 49739, 587 ONEANDONE-ASBrauerstrasse48DE United States 14->30 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->48 50 Tries to steal Mail credentials (via file access) 14->50 52 Tries to harvest and steal ftp login credentials 14->52 54 Tries to harvest and steal browser information (history, passwords, etc) 14->54 56 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->56 58 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 18->58 60 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->60 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e1c451d08aec80a5064e6b93aa89ca1955dcf120dd81f1114d065203a6afabb/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 09:36:45 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=byoekhiiv3eauude424tvke4ugkv3tysbxmb6eiu2bssaotk7k5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07c1066fd37658b1d3c9faa6f43f3e467c6bcdd341cec916f9a0c6e993d5d74a
AgentTesla
168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3
AgentTesla
5b038d7385cf7cfa9aac553b025a1b686c90a9f692a7ad78d817e56aaf5ed935
AgentTesla
791232ba8efdbe3778e195b4a96173183e44d101af42f0b308cca758ccd4d17c
AgentTesla
7b13c46563325621aa15ff5ff9b39f5ea09367e4e91a16a7ff4cdcd52e0e5332
AgentTesla
9084d540bb1b53268cfa8b0372d5ea3769040050deda186264ff5127f1dcc698
AgentTesla
c3624982c4e27761f6d132bb33b9fd3618642fdc0cc5949a6207ceef392b3d8a
AgentTesla
d62db8a909debd7ac39dca5850db5bf150756f27cc50417efc285a812b378b84
AgentTesla
ddd2c3304f4423f4348cf0d858ecba70eaaba5b652969d5f582a534ccfb55093
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
+ 3'171 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/210311-32jga88dkn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
0e1c451d08aec80a5064e6b93aa89ca1955dcf120dd81f1114d065203a6afabb
MD5 hash:
954d0c04696cc51fc9c2d3473b7663f4
SHA1 hash:
3c8df750fd6ef891b2748e18312767208780a781
Link:
https://www.unpac.me/results/c7640816-0c10-4790-8b7e-d918d412e562/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e1c451d08aec80a5064e6b93aa89ca1955dcf120dd81f1114d065203a6afabb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/123783/

Comments