MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c
SHA3-384 hash: a27d0878f8c309b12f2948ff9ccd3fa42ea2abc7f38d60cb36f851b33df6dc539916087bf7740adec75407f76c40e1eb
SHA1 hash: 1a8465dec98a5f11d94e4f30bdc5189731e132f3
MD5 hash: b20a05777d6abd6832bc55fec2400633
humanhash: chicken-earth-autumn-sixteen
File name:New Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'480 bytes
First seen:2021-07-07 17:01:43 UTC
Last seen:2021-07-07 17:43:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'624 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:ldb8EKlXgFxY3wBeTXBztNVAGM+H/pQVDFYwT0YDpO0P7r9r/+ppppppppppppp7:QdLKJEpDwFdO01q
Threatray 6'435 similar samples on MalwareBazaar
TLSH T151F44B69E9441667EB3A97304A32C830F13A6CEA35309C9F15CB3D5B367F5422DA632D
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New Order.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-07 17:05:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/507853b5-a772-4cc7-ba63-bbf6f2ed75a7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170260/
Detection(s):
SecuriteInfo.com.Variant.Bulz.349164.17804.2769.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/37c78409-49ff-449d-918c-39b9a63381f4
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/813037
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 445448 Sample: New Order.exe Startdate: 07/07/2021 Architecture: WINDOWS Score: 100 16 Found malware configuration 2->16 18 Multi AV Scanner detection for submitted file 2->18 20 Yara detected AgentTesla 2->20 22 9 other signatures 2->22 6 New Order.exe 3 2->6         started        process3 file4 14 C:\Users\user\AppData\...14ew Order.exe.log, ASCII 6->14 dropped 24 Injects a PE file into a foreign processes 6->24 10 New Order.exe 2 6->10         started        12 New Order.exe 6->12         started        signatures5 process6
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-07 15:00:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
41
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2kage6chcd5dvtchdhdhsw2kzem63dnhkurodfg4gw45kshrsga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
113a77824329e62d8a2268075f4e8afa9756a9e134d46e87a61618d7b426b9af
AgentTesla
33ea296a82c06a50910b4c4ec26a31c5e6af0e3c68519018adf4941122d627df
AgentTesla
47c165f0ea4d4fab9dda4533c75df285e5d9c181669e41a393d4bbcd40de5332
AgentTesla
488e95bfe1dbcec59e4d18c057e251a576feb8cf0b8222d1ebeefee8121bbd7a
AgentTesla
6b6a6cb45c75ffda98874ecb88f2fbc1ec1737222116967459117d6d8d36ecc9
AgentTesla
a0c276ad8ae88e240aa321fd9d38faea9423e7e16fe7eca1e7ffc69cc1e63817
AgentTesla
b714843003128fbb1f579c92ba69e28535994d462ea06068fe3f9909311f2902
AgentTesla
b94319b3e68cd50dad3f1f6b4b00081a59427eb0cf8b3c1be909db7d57066de0
AgentTesla
bf0db33fa824c9d43e1b88c525cc921c1c65be0920faf1615ffce9324fe7df48
AgentTesla
f1b83a44c460dbf9d967fba2ad03945ceb6d0502b23d5abf14175c85244e4cf7
AgentTesla
+ 6'425 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210707-4q52hy9wee/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/33492565-fd0a-4d3f-b9ee-deb54501b0f4/
SH256 hash:
b0a9c230cc23d320eb3da2377dc7f8bcc7103ea9fb3c4fa8545753845dc24332
MD5 hash:
3c5f4aebbb2f8cb4597549241882c399
SHA1 hash:
528de036085069f42c2c4f5873c41d37d5dfcb8f
Link:
https://www.unpac.me/results/33492565-fd0a-4d3f-b9ee-deb54501b0f4/
SH256 hash:
be0907602c826e11c75dc9935d725bb43e3790b0be043904d717aef91452024c
MD5 hash:
7d02fbc4ef0ed2172d71e45a39dfdffd
SHA1 hash:
0990d1e1f209edf8de08a400dbe5f752cbfead7d
Link:
https://www.unpac.me/results/33492565-fd0a-4d3f-b9ee-deb54501b0f4/
SH256 hash:
0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c
MD5 hash:
b20a05777d6abd6832bc55fec2400633
SHA1 hash:
1a8465dec98a5f11d94e4f30bdc5189731e132f3
Link:
https://www.unpac.me/results/33492565-fd0a-4d3f-b9ee-deb54501b0f4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dridex_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/170260/

Comments