MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21
SHA3-384 hash: 44b386bf27c20ad827bee7344b978c58bbe496ad078222499c8cce7a87dabe9fd58cb27f1b02cd20c47bee87326462f9
SHA1 hash: 77d9143150057aab0905286f9f6263f9c3e64a78
MD5 hash: 8d7b456c3d492d28f7020f1d87ebccb4
humanhash: football-uranus-beryllium-fourteen
File name:nwamafour.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:51'712 bytes
First seen:2021-04-28 06:15:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:/ovTV42ETk7kH4rwlSFpv9xGiwgNvSxCG:Avy2ETk7kHLeQiw4Sx1
Threatray 4'269 similar samples on MalwareBazaar
TLSH AB339DA6988E43FBD349003909F38D15036E972D5812B62699AE115CB91533F4FE3AFF
Reporter TeamDreier
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
nwamafour.exe
Verdict:
Malicious activity
Analysis date:
2021-04-28 06:18:19 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/4ec0f425-d8fa-4dd8-9263-c6b778248785

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144827/
Detection(s):
SecuriteInfo.com.Artemis8D7B456C3D49.15468.3350.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Moving a recently created file
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a window
Using the Windows Management Instrumentation requests
Changing the hosts file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8624d7cf-5843-4077-b4f9-958b589b3837
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/700091
Signature
Contains functionality to hide a thread from the debugger
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 398966 Sample: nwamafour.exe Startdate: 28/04/2021 Architecture: WINDOWS Score: 100 33 dell-tv.tk 2->33 45 Found malware configuration 2->45 47 Yara detected AgentTesla 2->47 49 Machine Learning detection for sample 2->49 8 nwamafour.exe 15 10 2->8         started        13 WerFault.exe 2->13         started        signatures3 process4 dnsIp5 35 ldvamlwhdpetnyn.ml 172.67.208.174, 49711, 80 CLOUDFLARENETUS United States 8->35 27 C:\Users\user\AppData\...\sdbglb0k.newcfg, XML 8->27 dropped 29 C:\Users\user\AppData\...\dzvpnxiw.newcfg, UTF-8 8->29 dropped 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->53 55 Hides threads from debuggers 8->55 57 2 other signatures 8->57 15 nwamafour.exe 2 8->15         started        19 cmd.exe 1 8->19         started        21 nwamafour.exe 13->21 injected file6 signatures7 process8 file9 31 C:\Windows\System32\drivers\etc\hosts, ASCII 15->31 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->37 39 Tries to steal Mail credentials (via file access) 15->39 41 Tries to harvest and steal ftp login credentials 15->41 43 2 other signatures 15->43 23 conhost.exe 19->23         started        25 timeout.exe 1 19->25         started        signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-28 06:16:15 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e365aca3f6a945befe7e6f6e59d184719abc62d312e1bf2c9a873062ab5aa5f
AgentTesla
3e81cacf8070232edbe7c2443a72df9d59d4631b8d74a0d513aa535bef475a02
AgentTesla
4a9f65c36f2f23acdba1e9d4aa7ac525822441e2a7ae14afcf8808dc86f0405c
AgentTesla
4d451eddbf3edc6f1038d1706253491f5912ef73f093d7ffa95b164f80b71384
AgentTesla
8160d7520a2f9630dc0b3773b07d2a9fdf937f2b3b722980c96dfbc4db4a85a7
AgentTesla
8b9abfcdfed4c5a95b6425c5ca75d7b0a17e43e42d6f78cca6f7d8e8c2d7a967
AgentTesla
8f75c88c3376308b7053698d849a6f228cd9ebde1fec893fa850d4fa9e9ac25a
AgentTesla
a5b4a1aa53134e93a392b7b90cc7c5d4a939d4f61bdf330de08d49fa1b4356ed
AgentTesla
efc33e49a1f2bb8a2caf20a3609c44170c3739c90c1e2f4f236961e13279a3b3
AgentTesla
f05d2a28234ee0f0d9997e2d8101df57dfcb78bd48557fa70ddb65d6f64bf5e2
AgentTesla
+ 4'259 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210428-78pqnhdd1s/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21
MD5 hash:
8d7b456c3d492d28f7020f1d87ebccb4
SHA1 hash:
77d9143150057aab0905286f9f6263f9c3e64a78
Link:
https://www.unpac.me/results/51231a6b-97cb-440a-8b3c-39beef26c3a0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/303cf0969720059305f095045e89ecb76c87f0b7473723ea9c09e534a99f1e21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144827/

Comments