MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458
SHA3-384 hash: a24d339097a4662c663d66df779df355f81d6125a7ff86e513f4a1605930bf9d261a94155def795a204046e27b54f3a1
SHA1 hash: 7637a699cad3ebf629503895db286f03342fe387
MD5 hash: ac8680d504a79d352283c90bf89e322d
humanhash: juliet-georgia-may-india
File name:SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:622'713 bytes
First seen:2022-11-15 09:02:23 UTC
Last seen:2022-11-15 13:17:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki)
ssdeep 12288:VP7r9r/+ppppppppppppppppppppppppppppp0Ymp9DK5qDSWjNvs47y/N+BPNIh:V1MmpU5qDSWZvst/emEThPhEJ
Threatray 19'831 similar samples on MalwareBazaar
TLSH T1EED4BDC5E98165A1DD19AB306A36CD3582237EFDA874A41D29DE3E273FFB2D31026053
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon d4c4c4d8ccd4f0cc (241 x AgentTesla, 65 x Loki, 41 x Formbook)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
128
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
agenttesla
Create hunting rule
ID:
1
File name:
SOA.exe
Verdict:
Malicious activity
Analysis date:
2022-11-15 09:03:10 UTC
Tags:
agenttesla
Link:
https://app.any.run/tasks/2e73e5ea-4e65-4672-aed4-394165c257f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/334138/
Detection(s):
SecuriteInfo.com.Trojan.Garf.Gen.10.22720.21164.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Reading critical registry keys
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Stealing user critical data
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/52602/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/637355c76fda73cab64de367/reports/36d9feb2-17c2-4411-b7e5-dee202947caf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0b303588-7da8-49e6-a62d-88aacf9d0e4f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1113618
Signature
.NET source code contains very large array initializations
Creates multiple autostart registry keys
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 746314 Sample: SOA.exe Startdate: 15/11/2022 Architecture: WINDOWS Score: 100 66 Malicious sample detected (through community Yara rule) 2->66 68 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->68 70 Yara detected AgentTesla 2->70 72 2 other signatures 2->72 7 SOA.exe 18 2->7         started        10 yriqvd.exe 2->10         started        13 yriqvd.exe 2->13         started        process3 file4 28 C:\Users\user\AppData\Local\Temp\gnwzpd.exe, PE32 7->28 dropped 15 gnwzpd.exe 1 2 7->15         started        80 Multi AV Scanner detection for dropped file 10->80 82 Detected unpacking (creates a PE file in dynamic memory) 10->82 84 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->84 88 2 other signatures 10->88 19 yriqvd.exe 14 3 10->19         started        86 Maps a DLL or memory area into another process 13->86 22 yriqvd.exe 3 13->22         started        signatures5 process6 dnsIp7 30 C:\Users\user\AppData\Roaming\...\yriqvd.exe, PE32 15->30 dropped 50 Multi AV Scanner detection for dropped file 15->50 52 Detected unpacking (creates a PE file in dynamic memory) 15->52 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->54 64 5 other signatures 15->64 24 gnwzpd.exe 17 4 15->24         started        32 52.20.78.240, 443, 49717 AMAZON-AESUS United States 19->32 34 mail.indembcairo.com 19->34 42 2 other IPs or domains 19->42 36 mail.indembcairo.com 22->36 38 api.ipify.org.herokudns.com 22->38 40 api.ipify.org 22->40 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 22->56 58 Tries to steal Mail credentials (via file / registry access) 22->58 60 Tries to harvest and steal ftp login credentials 22->60 62 Tries to harvest and steal browser information (history, passwords, etc) 22->62 file8 signatures9 process10 dnsIp11 44 mail.indembcairo.com 41.187.100.9, 49714, 49718, 49724 NOOR-ASEG Egypt 24->44 46 api.ipify.org.herokudns.com 54.91.59.199, 443, 49712, 49719 AMAZON-AESUS United States 24->46 48 api.ipify.org 24->48 74 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->74 76 Tries to steal Mail credentials (via file / registry access) 24->76 78 Creates multiple autostart registry keys 24->78 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-15 09:03:08 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fh3c6q4rihpndm4o7gfnwmnhkbfoubgosychubnqkcthep4uurma._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c220e85384289de8d43ef19cbb91ab72dd48d4726d90e58ee4ac5dfba40a996
AgentTesla
2a7f4ff5530858f39321d14a3d55315ed9c616cb352e080467968a8f7904849c
AgentTesla
6a11cc4a941a3406dbe63e9f5e643b01fe5bb678f221fec4b94a0a527b444b9e
AgentTesla
78b6ce875a1b01ef080709eac54c3757ed5a2dc4f69978716eafb7e96e4515d5
AgentTesla
9f7982f678ad089efedf1ebbbe9fc890ac396061ca36db87288d0fa84a26b039
AgentTesla
a2f90535274bd659bbe05e158249d8eb766b75fd803c0a1a5aacda3f808f68b4
AgentTesla
b6a7e17e7a419a7627495bda74f392db350508a36cc2a089342374e343fe0a06
AgentTesla
+ 19'821 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/221115-kz15eafg59/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/afcc5956-6f01-4cef-86c9-ba5f9d6a4d0a
Unpacked files
SH256 hash:
6d8a1a842dc546ca6ef1d7f9d6e396fd611f7d5c133eb048ac33a04ced31fc1f
MD5 hash:
84396753521d82b3673e68de56d7e544
SHA1 hash:
fac0502898cd43bde42ceba8cc4ed72683dd8838
Link:
https://www.unpac.me/results/8d213a7d-8e09-44d4-a92a-6dba9341f871/
SH256 hash:
21846d1b190ced3924851215255aa6f9491cacb892e37fac079d7addd54293e1
MD5 hash:
ba1c4361a3cdc25e6c867c30d4add0a9
SHA1 hash:
5d7c39e9f459df9ddd2fd9e72f3f2c970df6d4cf
Link:
https://www.unpac.me/results/8d213a7d-8e09-44d4-a92a-6dba9341f871/
SH256 hash:
aebfb9f0874e07b48942ff178b19345a97e2f90d5ff7ae90d57d586b95d34085
MD5 hash:
f95707dea8164e4b6e85f0c7c70edca5
SHA1 hash:
21ce3bce8db06baabc18dad96e8af9dba2be1619
Link:
https://www.unpac.me/results/8d213a7d-8e09-44d4-a92a-6dba9341f871/
SH256 hash:
29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458
MD5 hash:
ac8680d504a79d352283c90bf89e322d
SHA1 hash:
7637a699cad3ebf629503895db286f03342fe387
Detections:
win_cannon_auto
Create hunting rule
Link:
https://www.unpac.me/results/8d213a7d-8e09-44d4-a92a-6dba9341f871/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/29f62f439141/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.93
Link:
https://yomi.yoroi.company/submissions/29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_AgentTesla_d3ac2b2f
Create hunting rule
Author:Elastic Security
Rule name:win_cannon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 29f62f439141ded1b38ef98adb31a7504aea04ce96047a05b050a6723f94a458

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/334138/

Comments