MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 170984e2f23a42f3b24c75674b111aa8abb870bbd9e70f15ca3a7e6abf4e1ab7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 170984e2f23a42f3b24c75674b111aa8abb870bbd9e70f15ca3a7e6abf4e1ab7
SHA3-384 hash: 068ac4334695d3eab7380994edad02c1c51b6e3025b1e4f911ae5c4ee43f685d2336e68b5426dd54a4d7d82be00f222f
SHA1 hash: 8cef9a07b74b3f077e67f204230d43644403ab2f
MD5 hash: 7f1599b18ba48fe371d5ea7b83ad177b
humanhash: alabama-alpha-yankee-red
File name:2020-08-18 order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'006'688 bytes
First seen:2020-08-19 13:42:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e877e52c1d0025820b0d8228acf49bf6 (15 x AgentTesla, 14 x Loki, 4 x Formbook)
ssdeep 12288:w+p7p8KESESHe4/gD6WDSqWl/LDGTGM5irKedP0KxYIiCjgZI8UkImvyFMuMnXSm:7tRES4DBSq2KG2bF0imxkI6yN8Cm
Threatray 9'292 similar samples on MalwareBazaar
TLSH C7257C66B2A0CC3EC0E62539DD17D6F57825BE20E9275C477AE83C4F7F3D690242A192
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/48584/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.RatNET.2.27528.17296.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Launching a process
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Blocking a possibility to launch for cmd.exe command interpreter
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/438278
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 271616 Sample: 2020-08-18 order.exe Startdate: 20/08/2020 Architecture: WINDOWS Score: 100 62 Detected unpacking (changes PE section rights) 2->62 64 Detected unpacking (creates a PE file in dynamic memory) 2->64 66 Detected unpacking (overwrites its own PE header) 2->66 68 6 other signatures 2->68 8 taskmrg.exe 2->8         started        11 2020-08-18 order.exe 3 3 2->11         started        13 taskmrg.exe 2->13         started        process3 signatures4 70 Detected unpacking (changes PE section rights) 8->70 72 Detected unpacking (creates a PE file in dynamic memory) 8->72 74 Detected unpacking (overwrites its own PE header) 8->74 78 3 other signatures 8->78 15 taskmrg.exe 8->15         started        76 Maps a DLL or memory area into another process 11->76 19 2020-08-18 order.exe 18 7 11->19         started        22 AcroRd32.exe 39 11->22         started        24 taskmrg.exe 13->24         started        process5 dnsIp6 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->52 54 Tries to steal Mail credentials (via file access) 15->54 56 Tries to harvest and steal ftp login credentials 15->56 58 Tries to harvest and steal browser information (history, passwords, etc) 15->58 26 dw20.exe 15->26         started        50 api.telegram.org 149.154.167.220, 443, 49733, 49734 TELEGRAMRU United Kingdom 19->50 42 C:\Users\user\AppData\Roaming\...\taskmrg.exe, PE32 19->42 dropped 44 C:\Users\user\...\taskmrg.exe:Zone.Identifier, ASCII 19->44 dropped 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->60 28 RdrCEF.exe 68 22->28         started        31 AcroRd32.exe 7 6 22->31         started        file7 signatures8 process9 dnsIp10 48 192.168.2.1 unknown unknown 28->48 33 RdrCEF.exe 28->33         started        36 RdrCEF.exe 28->36         started        38 RdrCEF.exe 28->38         started        40 2 other processes 28->40 process11 dnsIp12 46 80.0.0.0 NTLGB United Kingdom 33->46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/170984e2f23a42f3b24c75674b111aa8abb870bbd9e70f15ca3a7e6abf4e1ab7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 13:44:09 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c4eyjyxshjbphmsmovtuwei2vcv3q4f33htq6fokhj7gvp2odk3q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1a55a181a00b302c127b8871d999942cd3f9b83cfb3172cca4894fbbea1b668f
AgentTesla
24f80789eeb2658a6dc8b9d022cff3cc88a1a6c22b33dd3ba3f9a1531af4a895
AgentTesla
254920e6788f4cb4975f08c5deef07e932f4a370a38c5197d7a4fb7846ea63ae
AgentTesla
44096c1493b07b6097e73099250d28081e1729e2181420e90b5913030c9687b2
AgentTesla
4d999c1660ff34c639225029732ed7aa9b3af03e5b20c054e9310f1f208fb608
AgentTesla
58df4d2cea8c94b519a4ef3b44a26236a318202a7f651fc8bf2fb65cf75942e8
AgentTesla
6b2503a98a3f1b29173e7e42867b4ac5e21a825348b791ad4a6ea12966720514
AgentTesla
8a1c7d516ce87b96194a19289d40a13f1cde869e3cfa844c3ec5a0b3a8899d38
AgentTesla
d58f997b8ee320ecd735457793e3f266ad3108dcc3306274431fe34c22f903fb
AgentTesla
f64f6cdf34223961fe65653d8fd5d66dc2fdc3e5d56422cdc5923765f78cf47d
AgentTesla
+ 9'282 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200819-epyvwvvy3a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/170984e2f23a42f3b24c75674b111aa8abb870bbd9e70f15ca3a7e6abf4e1ab7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 170984e2f23a42f3b24c75674b111aa8abb870bbd9e70f15ca3a7e6abf4e1ab7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/48584/

Comments