MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10
SHA3-384 hash: cff90bb87383aba39bdc4c15faa953c7fcf054531cebdd4ab7ecbe1293fce2dc8841b68297d5021d884dde2c232c1467
SHA1 hash: 13f239a39981a0fa80f055a3c54b7ca81e7ea8b8
MD5 hash: 990c66eb97768536e12066be9e23d65f
humanhash: quebec-floor-social-music
File name:Office 365.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:218'624 bytes
First seen:2022-01-31 21:52:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:mmQxDSSuggLLgbS6wnJ+XQUveLz9TUMQ8mALAjA4QymTrbEM8eY5/cF+JpIP:mq2bSTn0AUsJ9mcFbyYrbd8elF0p
Threatray 14'148 similar samples on MalwareBazaar
TLSH T1382429566758D561CB5F627EC01A820831F1D703972AD28F5AE2D8EA2F832CDF90BCD5
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Office 365.exe
Verdict:
Malicious activity
Analysis date:
2022-01-31 22:01:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/977949b2-548d-460e-958d-58907d30f1b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/228781/
Detection(s):
Win.Packed.Razy-9862812-0
Create hunting rule

Win.Packed.Razy-9865058-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
DNS request
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
hacktool keylogger obfuscated packed razy replace.exe
Link:
https://www.filescan.io/uploads/61f85a4018d1bfdde4e3d8b1/reports/b81fcedd-8f1c-4a65-9eeb-6976995485d9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3f139677-b5f4-4631-9710-f9f83660b4ee
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/931271
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 19:38:14 UTC
File Type:
PE (.Net Exe)
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fggwjkvjxigmab7nwzoh4qpcstpuojqib2r2e5iexxpau656fyia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19b17f5fee196217056fa20ab9d4a7e0b4969bcdcfc85984885cffd7bc9d9937
AgentTesla
1e358cdd08320d9b811ec7772ac2d2e3eb2a4c2d61da189a3a6aaa0cff000c97
AgentTesla
223c29479c3d11deac18cb722d213378d0918fbe95efb1ab053c56f94ec04b09
AgentTesla
7410ac67979b82ac850d90f1e3a66494c958952c54fcd1035f78f3b84ed4d7b5
AgentTesla
85f2e664b113cdbd49156057515ddedc60ba32235e49257b44854a7be52eb77e
AgentTesla
b996aa93cfd2549ee1548a4940194b421808975059805614ef9b40bb5e75c8d1
AgentTesla
bb422900a755e4aa68626b1451545a2e36e1acf79d975ae6bda7da78313c3205
AgentTesla
fa74f2f2fde3b73f53ee495fdfe25b5fb3866f240e933e9a5dfad695c8d9f962
AgentTesla
+ 14'138 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10
MD5 hash:
990c66eb97768536e12066be9e23d65f
SHA1 hash:
13f239a39981a0fa80f055a3c54b7ca81e7ea8b8
Link:
https://www.unpac.me/results/8bb11b31-70d4-4bb1-ba5b-192cb218e05d/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/298d64aaa9ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 298d64aaa9ba0cc007edb65c7e41e294df4726080ea3a27504bdde0a7bbe2e10

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/228781/

Comments