MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3
SHA3-384 hash: b44a206115b1ab6bfc4b81fdb3bc124f5a64507c0dc512d0f944e1553405198dfac93fb92744b82f0548037bc6bd0af5
SHA1 hash: 82b1b648692329bb6e9717a70c4be861517a1585
MD5 hash: 635810567724d851329c7b597084cb25
humanhash: asparagus-batman-aspen-venus
File name:UwA4VF8Q47llTPK.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:906'240 bytes
First seen:2022-10-04 06:12:15 UTC
Last seen:2022-10-04 06:27:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:MK4HTNPbUpS2QNS1BYBy8QYaLSbcDlPeBpj6znilkSj9pcVHfJhm3rKn:WT26S1BYByddHhApZ9pcVRo3m
Threatray 20'330 similar samples on MalwareBazaar
TLSH T1C215E02203E29B0AC1125374CDD2D3B0AFE84E64E6B1C2474FDDFDABB47B5A9BA50145
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter cocaman
Tags:AgentTesla exe payment

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316336/
Detection(s):
SecuriteInfo.com.BackDoor.RatNET.2.823.19537.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/633bcef0896404d760d7a46e/reports/3d2ee799-b12f-4ca3-a64d-f2aefb9ac77b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bea9d405-c290-44d6-8d53-7518c5cad44c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1082985
Signature
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 07:04:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d3ywv47xmqxmanjz7j3adkk7mv3kdfww3r3zbietrhkgd6i2cszq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3785ea3b9088f8540d543c65142f3c6017114193dd6fac36c5de18cbfa1102a7
AgentTesla
63cdda46a08c3038d94c60c3dd0ac398eb2d5b56568870bd4128b835a41d7c4d
AgentTesla
8d75529a8c51cb0ba57f63afe69cfbb3af95c5087946ad4de20634c86a5abf3c
AgentTesla
b27c6b257151b39a26f528bf4511bae9b795493cb54cf2d31676ae586ee74e86
AgentTesla
bc0a1153681fd21f8ea15a81e41d256a7a10623554db56a74d2b244547248e7c
AgentTesla
+ 20'320 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/221004-gyrb2afbg8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5380301623:AAEiiAoD9x5hD8Dpz7EhZFXpW2UQGzFYtzs/sendDocument
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c2c88f6c-caed-426c-b5ac-5ce6bf19caf6
Unpacked files
SH256 hash:
4fca3db55ae7bc74e18e575e54a380ec3f2814d6cf3f9f671b7402b55d668bf5
MD5 hash:
c725c2954164f839078bec4fece6477d
SHA1 hash:
f64c1a3ac8d558816fb057ab8c1f93e6a1aac54a
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
SH256 hash:
a04c799fa302c78d04acc3b4be8ccbde2f7fa00fe515daf18a2fc7e65fad3b13
MD5 hash:
d76812ec4cbc45e1e26ed36691596f7e
SHA1 hash:
c854fe9792694fb464a0bed51c737ff61ccef736
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
SH256 hash:
ef98b1547c3045a9e9ea349c6b0ec04f4c905f322f5b9156f3d7bcf56008095d
MD5 hash:
e29d8081a281e83c6e9208eb814c08fc
SHA1 hash:
33122cde2310a371d607f59627788d5cad6e0a44
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
SH256 hash:
92d7f6fbfa571a74e98520116d1be8c3164a9c769c02a563f0794a7e56376c7d
MD5 hash:
3fb1180dbdab2de2fe0e816f1ff5bf71
SHA1 hash:
24deaeb50ea930e6b94b3a84ee9f1481aa34fd32
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
SH256 hash:
e20ec8f3c957bcb6a194ef688bae8af2015cfffb20e7baf8b2114d7b70ade4ee
MD5 hash:
35cb29046968faca7f3f3b4463449b6c
SHA1 hash:
088c8c30ec1bece0a4b5bbfe3982b073f8b95598
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
SH256 hash:
1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3
MD5 hash:
635810567724d851329c7b597084cb25
SHA1 hash:
82b1b648692329bb6e9717a70c4be861517a1585
Link:
https://www.unpac.me/results/265e7ac0-edef-46d9-ada9-de818f62d50f/
Malware family:
AgentTesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1ef16af3f764/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 8f9939c5f5893ef25709627e398f9f07320b4e7613044f0ae61085d2c23c336a

AgentTesla

Executable exe 1ef16af3f7642ec03539fa7601a95f6576a196d6dc7790a09389d461f91a14b3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8f9939c5f5893ef25709627e398f9f07320b4e7613044f0ae61085d2c23c336a
Cape
Cape
https://www.capesandbox.com/analysis/316336/
  
Dropped by
MD5 e62b5a4927820056839c68f5db1d35c2

Comments