MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f4eea75504a04671e8d79c9ecfa2accb453b57cad71e4313c6c458912f64eb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f4eea75504a04671e8d79c9ecfa2accb453b57cad71e4313c6c458912f64eb2
SHA3-384 hash: cc2aeae85761e0a2d055ce44a1e78a84eb785c9f5b97bf3d3a99db71756e872f2a67a83a0c023ffc272797e6c208b95f
SHA1 hash: 492a18e90c440ecce4068f9f99e83cc2c3e9d73c
MD5 hash: f5c307fc6848bbbd4b6a538d0b3fc17e
humanhash: oregon-stairway-coffee-mars
File name:New Enquiry 200567.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'176'064 bytes
First seen:2021-05-10 14:01:49 UTC
Last seen:2021-05-10 15:04:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:3yCR1+0PKpAnRI+hd7uuPrApKBT1eWIQ3uP7sCUaWe7nmKvh7IV3S/sz7+TV0JSn:3ZE9R+zF9ZeP7sCUawKitS/y+TV0J+U
Threatray 4'734 similar samples on MalwareBazaar
TLSH AF45079D761076DFC86BCD728A681C64EA9078BB830BE207906715EDEE4D997CF140F2
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/154134/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/777504
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f4eea75504a04671e8d79c9ecfa2accb453b57cad71e4313c6c458912f64eb2/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 07:39:40 UTC
File Type:
PE (.Net Exe)
Extracted files:
29
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
590d1a6a1fa00812284d4f5e4f47cb34d4965c79bfc9ec1741f2a8e14967719b
AgentTesla
61d4dd89bcb94b321942a0ebc30ad2319411eff15bc24ab4769fd00a20a92188
AgentTesla
ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
AgentTesla
b1601867a9da1a51e59ddfc6c1d2d4cae7190945cbc163a04400a1b2b872aee8
AgentTesla
cd68a939631bc27a38fba500b03efd3268f5a3269880f3e635347de8b6ba2d2b
AgentTesla
da07baff79d46d664a2d464e7f386e4719e4cd1b183e5dd9d9a7fcbcf45a573a
AgentTesla
ea4d7ae710b25f166a8d0a4254983d69ac60da4f6846bf912362c00f8e25c382
AgentTesla
ebdb5f9167c925da14a5783a022be63ac4daeeb7515692c7cd50c37a7851e7e4
AgentTesla
f148b6ad99c39c47a48a82fc4959b98ccfed28b35556ea3e0f07d0b8911d5e15
AgentTesla
f349ed3a3e5bab8bc5694ba8885e6717c049064394682b240afe62ede7f67a9e
AgentTesla
+ 4'724 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210510-tgxv6bmh6n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f4eea75504a04671e8d79c9ecfa2accb453b57cad71e4313c6c458912f64eb2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/154134/

Comments