MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50
SHA3-384 hash: bff85d208b4e1327a3757a970384cee3a0f1ea75baafde8bc8985d3cd3d6fdaa83b7f486e6470bc156b0d7e6323fec5e
SHA1 hash: 8b70cf0d7cb0af5b44562193a622995ecb2af72d
MD5 hash: 7c5c38a3fb114ecda0b3bf8edd4ae56e
humanhash: carolina-king-neptune-zulu
File name:SOA 2908414.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:864'256 bytes
First seen:2021-06-25 06:39:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:x2l5JZaF75GF25zGWSE5D1kIpNPp23yfRAPeoCWYXZHf0G7nNn3eYY2mr7:JbwhEp1pxfR40RYTv
Threatray 6'126 similar samples on MalwareBazaar
TLSH D205D02C3A9D5175F1F6AF780AD03591ABEEB61F6702D41C28B1CE493633A40CDAD939
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA 2908414.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-25 06:42:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2ba7d082-f764-4cb1-a77f-8e238f5c10d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168239/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.867-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20210625-0504.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/af4cde62-054d-4a90-9a54-759af4b975e9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/807945
Signature
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Process Start Without DLL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-24 21:51:20 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ektqw53cdaakelxhzh5ynqegjgqqdrdoq7vglgs3jbdaxiy5j5ia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e86d6422b2d8c7eb8196d01b6057cba5dcc3c937b9359680f6fc7bd9440018a
AgentTesla
3280a97200b04ee7c4269d468acdde031570d46d59b7991948c22fcf9fbf4773
AgentTesla
432cbd06688167972b7ac8187acb05c6a7922f378813145ccc449f32e00a7833
AgentTesla
553f8d4b64f3f490db02424ac3613857f2fa288a63442a78414fa5393feaf2c7
AgentTesla
70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84
AgentTesla
7c5f8a44d779547d1fafecc0d0797d15e09779b2bef71aded94d47d3cd9fea74
AgentTesla
82463fa24ce4a50ed4d98b3279d41bc14dabbee2cb211d8951e864ff6d83786d
AgentTesla
b9ca436fc3e5b7f746ecb8945b94045fbd922f97762f6e02fa2d41bc37e8a314
AgentTesla
df730a5c1462ced883e78b64dbb7d34c7687b3e0b20914559a87a3719496818f
AgentTesla
f86da0984972a912636cd654ce3650c36b600e2b69ed6276b5b898519bec6f48
AgentTesla
+ 6'116 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210625-hq5arq7gee/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5bbef96d7bd9709121949f5821af6bae5aa6a3b823e584b4902236a2be72d0c8
MD5 hash:
77c2046d5fb72e5e03001eecb56e794e
SHA1 hash:
ab80f7b2ff111f5b070ba1e1766cac0c39ea93af
Link:
https://www.unpac.me/results/8e922994-08d2-40a3-aefe-bc2c67d1cd3c/
SH256 hash:
a72225662a75e76c7de30d3180807ff4a99b59a416cb763b5d80ed809bac58a1
MD5 hash:
b372dc64888d0bef02132b1ba385c71c
SHA1 hash:
22b37762b5a957859c6ecbcd8a773e5cb52ee770
Link:
https://www.unpac.me/results/8e922994-08d2-40a3-aefe-bc2c67d1cd3c/
SH256 hash:
b50285d4e486fcc8af31816a1267bf1940c232bb6d0e761b934bbfd6f23ff76c
MD5 hash:
80891724eb8388e9526211e8c2919458
SHA1 hash:
0a67f0cdb96667c54bf93daac6c46ef19a6155a4
Link:
https://www.unpac.me/results/8e922994-08d2-40a3-aefe-bc2c67d1cd3c/
SH256 hash:
22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50
MD5 hash:
7c5c38a3fb114ecda0b3bf8edd4ae56e
SHA1 hash:
8b70cf0d7cb0af5b44562193a622995ecb2af72d
Link:
https://www.unpac.me/results/8e922994-08d2-40a3-aefe-bc2c67d1cd3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 112da541dbc30759efdbafe2fd339a542fc9ba2e14c1bd8a8a9ea14380c2572f

AgentTesla

Executable exe 22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 112da541dbc30759efdbafe2fd339a542fc9ba2e14c1bd8a8a9ea14380c2572f
Cape
Cape
https://www.capesandbox.com/analysis/168239/

Comments