MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827
SHA3-384 hash: dd484f7e0b0fe1a8f4065a3745f1b859dfd899f54efea5a7b718c65de0f91a7ca5605cab773542a78f845ec9ebb6cd94
SHA1 hash: b07343f4b3007ad98c24921cc220d53ea1c5f4f0
MD5 hash: 29a6f71888c0eb32d9d22141ebcd643f
humanhash: pip-saturn-diet-apart
File name:Invoices.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:42'984 bytes
First seen:2020-12-08 16:37:46 UTC
Last seen:2020-12-08 18:51:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 768:EPdrckn2Xb0ATnm9bfXxYXNSEKYpm/qxUzDBtiMOqyduA/HUf2hC:EPdwk2Xb0ATnm9bfLEvpittiMtyduA/g
Threatray 1'737 similar samples on MalwareBazaar
TLSH 8213B186370D8E43F6878B357603A3179B9992433B7B4BB1A6F813631C535C46A63B83
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cn.fujitsu.com
Sending IP: 156.96.62.55
From: Account Payable <Accounting@cn.fujitsu.com>
Reply-To: dawnimpax2012@gmail.com
Subject: RE: Due Payment Against Invoices
Attachment: Invoices.iso (contains "Invoices.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107311/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.11571.6060.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
DNS request
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a file
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/558222
Signature
Connects to a pastebin service (likely for C&C)
Executable has a suspicious name (potential lure to open the executable)
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328210 Sample: Invoices.exe Startdate: 08/12/2020 Architecture: WINDOWS Score: 72 20 g.msn.com 2->20 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected AgentTesla 2->26 28 Executable has a suspicious name (potential lure to open the executable) 2->28 30 2 other signatures 2->30 8 Invoices.exe 15 3 2->8         started        signatures3 process4 dnsIp5 22 hastebin.com 104.24.126.89, 443, 49726 CLOUDFLARENETUS United States 8->22 32 Hides threads from debuggers 8->32 12 cmd.exe 1 8->12         started        14 Invoices.exe 8->14         started        signatures6 process7 process8 16 conhost.exe 12->16         started        18 timeout.exe 1 12->18         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 08:38:47 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eisq36bqi7t43lojvsu3khsykjv3ntj32uile3z7zgc5dzoovatq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0ea9918fde5a26af008b03a8f9dbccb1e48070ab92b8ae0651f1e80fb8dbce3a
AgentTesla
1a6a3ac02a5a13f30791093a6a47dc9aef9f4de415446a81f711975e85884044
AgentTesla
1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50
AgentTesla
320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e
AgentTesla
3700a970f0388eab91ae394304a67b22ed4132e47c6037805c175c9e9ea1d0d9
AgentTesla
3e8071aede5cd9dc2500f881d56bdd1f3e98fddf7029f991f80ac5b5f9f86224
AgentTesla
490d077b95439b181a68d695fe8496653bf3dd42d6e4baef1e7132b550e278d4
AgentTesla
683478f861e01bef5ec49d9ecdeaafd9c156811fc2e7b0acf28f2c9ea0d0fcc1
AgentTesla
ac84fce48dc5fc0ece582c6cd8f5486d044f48f2923e949d27c5ea44cb0a80a0
AgentTesla
f2cfe1f156f2ee4f47cb3d08b574d722b46918bf1daee7c37514253b9f653a61
AgentTesla
+ 1'727 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201208-98l4pd2tvx/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827
MD5 hash:
29a6f71888c0eb32d9d22141ebcd643f
SHA1 hash:
b07343f4b3007ad98c24921cc220d53ea1c5f4f0
Link:
https://www.unpac.me/results/5414093a-29df-4a3d-943b-5c13ab106284/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f

AgentTesla

Executable exe 22250df83047e7cdadc9aca9b51e58526bb6cd3bd510b26f3fc985d1e5cea827

(this sample)

  
Dropped by
MD5 db1c7bf0d4e5c8b0f795943bba037eae
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/107311/
  
Dropped by
SHA256 86014d3f47cbcebfd3623571f05b73f3d4a8b8722bb567a0ef52e91eb4c1054f

Comments