MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e
SHA3-384 hash: 60f4e16e797d8aad8e7f3a37ded40818a435641493ddc9dd06fa9c0411ef7c871121337a057a1551fdb41ec1db1611e0
SHA1 hash: 49a4e10a12d5aec836cc2b1cfcfce3784446929b
MD5 hash: 891f97173c0a90ed3d336e303908b38a
humanhash: steak-bulldog-burger-april
File name:attached TT PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:807'936 bytes
First seen:2021-07-27 16:07:34 UTC
Last seen:2023-06-08 14:55:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:V6clP7+3veAzRiEUSl/wzEbLZrBeW3Ujdj5EqxugE9i5/aFC5MkkCT9NILJuROEK:V68+jdhUSxd1EWkhNE8ux9iBXx0
Threatray 8'143 similar samples on MalwareBazaar
TLSH T18105F1057B81AF4EC57E8E3680115D50D7B1ED2B670BE78B2CD232EC69BE7D54A03292
dhash icon 1d19094a5b2f371e (26 x AgentTesla, 4 x NanoCore, 4 x DarkCloud)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174458/
Detection(s):
SecuriteInfo.com.W32.MSIL_Agent.CAC.genEldorado.1153.23015.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a38d8895-21c4-4b18-b960-2590234764e6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/822529
Signature
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 454942 Sample: attached TT PDF.exe Startdate: 27/07/2021 Architecture: WINDOWS Score: 96 23 Found malware configuration 2->23 25 Multi AV Scanner detection for dropped file 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 5 other signatures 2->29 7 attached TT PDF.exe 7 2->7         started        process3 file4 17 C:\Users\user\AppData\...\VzKaRFUJOv.exe, PE32 7->17 dropped 19 C:\Users\user\AppData\Local\...\tmp273C.tmp, XML 7->19 dropped 21 C:\Users\user\...\attached TT PDF.exe.log, ASCII 7->21 dropped 31 Injects a PE file into a foreign processes 7->31 11 schtasks.exe 1 7->11         started        13 attached TT PDF.exe 2 7->13         started        signatures5 process6 process7 15 conhost.exe 11->15         started       
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-07-21 22:03:25 UTC
AV detection:
32 of 46 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4syexbgjjzr6wn55yiizxmp34dckakajfjcstd73pkoi3kmzr7a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2ab9549c33a603c9c5fb061308f00aed45381483b8ffd4d897d73b2d6e002074
AgentTesla
4daabfcd77a576316374e25116ab3eac2c7e0f8ed029cd7921ea80cf7697fa8a
AgentTesla
6256cb8aff5a06b858693a93e28fe4a05424c16c07ef2ef5cec2f4c1465bc069
AgentTesla
a375deb96890081d86de1eeb938a56168262ebe0e18dd82065796ee026d89005
AgentTesla
e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd
AgentTesla
+ 8'133 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210727-q7xmab569x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
4d399727cbef3cb4dddb001c3980e6c35a6dc02f4ca6c0aa42266937d5d4825e
MD5 hash:
9c600ef35cbb4f906a98e6f84a30cc31
SHA1 hash:
bb52afde578cecb6db57ef3573b8838b851f9b1f
Link:
https://www.unpac.me/results/cb388537-4951-4cbd-9287-76ce4e233536/
SH256 hash:
937f06844e07b0afa1f92972c99e408b20f90ad8473f3f17b27a1886ed368762
MD5 hash:
cb937e4c69262259ae8a6860842c766c
SHA1 hash:
b5671569e0b96958c62fb0a487c743a8a2204212
Link:
https://www.unpac.me/results/cb388537-4951-4cbd-9287-76ce4e233536/
SH256 hash:
10b9630f91270903293db21fb4f563dac6cbc7b3ff0340325b14fafeab403eb3
MD5 hash:
79289e78f2e55b6f0b581dfebbbc83e3
SHA1 hash:
33dce7c24ed83aa7397098f76009bc443280a43d
Link:
https://www.unpac.me/results/cb388537-4951-4cbd-9287-76ce4e233536/
SH256 hash:
83d9e44d9a311ea6fdbcbd09fdc816a2067806dcacf24beb5ee786191b1a3ea1
MD5 hash:
b1a7b752b6638ee03cffe5a1dde9213e
SHA1 hash:
52d215a173d2f293990f8c12fc7f4a86330a29cb
Link:
https://www.unpac.me/results/cb388537-4951-4cbd-9287-76ce4e233536/
SH256 hash:
2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e
MD5 hash:
891f97173c0a90ed3d336e303908b38a
SHA1 hash:
49a4e10a12d5aec836cc2b1cfcfce3784446929b
Link:
https://www.unpac.me/results/cb388537-4951-4cbd-9287-76ce4e233536/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 2f25825c264a731f59bdee108cdd8fdf062501404952294c7fdbd4e46d4ccc7e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/174458/

Comments