MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ff007cbfed2ae4ed1697203a49fd66d97b9c2a4e38a77154049d62b0a96b683. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ff007cbfed2ae4ed1697203a49fd66d97b9c2a4e38a77154049d62b0a96b683
SHA3-384 hash: 09c2fd1e0579a1a0a337a43945426dd9bf0226a074bf639651bbd213dd58adb031ae8e1ad4f64f801ff3b9d353413169
SHA1 hash: 3b2d0e48d0a15a33a10ecca325f9bc86c9ab09f6
MD5 hash: 1422da85bdcc69fbd408cdc6cccc951a
humanhash: violet-floor-fifteen-high
File name:Prepayment Status.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:637'952 bytes
First seen:2020-07-29 15:01:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:pQeNRUE5/Lz8H4V3iKoP0T4W3oHSY/S5xSrb:pQevUwLz8YfoPxooxKLW
Threatray 10'575 similar samples on MalwareBazaar
TLSH 0BD4E168B7A5C920DFBE5279E1F80810CBFCA1859577D71A3984A3AB1CE3361F4046BD
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35039/
Detection(s):
SecuriteInfo.com.Fareit-FXU1422DA85BDCC.17973.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/402818
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 253747 Sample: Prepayment Status.exe Startdate: 30/07/2020 Architecture: WINDOWS Score: 100 32 g.msn.com 2->32 34 asf-ris-prod-neurope.northeurope.cloudapp.azure.com 2->34 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Sigma detected: Scheduled temp file as task from temp location 2->44 46 8 other signatures 2->46 9 Prepayment Status.exe 5 2->9         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\tmpD897.tmp, XML 9->26 dropped 28 C:\Users\user\AppData\...\&startupname&.exe, PE32 9->28 dropped 48 Injects a PE file into a foreign processes 9->48 13 Prepayment Status.exe 2 9->13         started        18 schtasks.exe 1 9->18         started        signatures6 process7 dnsIp8 36 smtp.taiemerica.com 13->36 38 us2.smtp.mailhostbox.com 208.91.199.223, 49748, 587 PUBLIC-DOMAIN-REGISTRYUS United States 13->38 30 C:\Windows\System32\drivers\etc\hosts, ASCII 13->30 dropped 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->50 52 Tries to steal Mail credentials (via file access) 13->52 54 Tries to harvest and steal ftp login credentials 13->54 56 2 other signatures 13->56 20 reg.exe 1 13->20         started        22 conhost.exe 18->22         started        file9 signatures10 process11 process12 24 conhost.exe 20->24         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1ff007cbfed2ae4ed1697203a49fd66d97b9c2a4e38a77154049d62b0a96b683/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 15:00:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7yaps762kxe5uljoib2jh6wnwl3tqve4ofhofkajhlcwcuww2bq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0352d55cf10867420b433bcd9adfdb0e39afe2484db5c57946bb86297a39ecbd
AgentTesla
0b8816ca9d3b6f03b3a60637504d206815c6bf230cf410ccce9af1bdea3d2839
AgentTesla
38620b79b0821d5fc2a7e230a3e2c31f30773a749451c3618414d83f82e884e9
AgentTesla
7c1c73ea7abca6e91c125085275f01c1964451c9444b5f76dfab7fd7a981dff2
AgentTesla
98870d9c6fd20e8f2737274c3e20cf222b0c82428e77eb470863f10b00c6838c
AgentTesla
a330dfb1074f6b02e49e5835f820821b0e75f691dac46057332381d172f640ea
AgentTesla
abe7a852074e704601e7fff625aa43e93ba71c6f0811aef9262b78e725df1278
AgentTesla
b770e145ef0e53fe2df0d45b04230e97dd214e209bfe9860dfa56988dd7d1796
AgentTesla
d04dfa9f36d64e850ec774b59542cf7e07167144fd6646c3cb3a99740ff75ce0
AgentTesla
fb48b5cc967c5bea1799607218168a28acf394c89b5d89de2b7a98ad1a2e0c8c
AgentTesla
+ 10'565 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200729-np887bhq82/
Behaviour
Modifies registry key
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/1ff007cbfed2ae4ed1697203a49fd66d97b9c2a4e38a77154049d62b0a96b683

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/35039/

Comments