MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3
SHA3-384 hash: 53183c54c830d87bcfe8669c5939124c294b3a241a33b0a61e6329f091e6b03f7ddac4a27a5c16ed477565bd4754974f
SHA1 hash: df7eb0bdeaa6d40fee0ce6dc7628f2db7e816f91
MD5 hash: b40fdde8238ff745c496c7d32f3a9a7b
humanhash: summer-pip-nitrogen-muppet
File name:Contract.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:435'200 bytes
First seen:2021-09-24 10:14:24 UTC
Last seen:2021-09-24 10:58:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:oGEHRanZyc7C82UX7SIhvy76TfbbmZ15BJ6ZAR:8q7C8bNhaGvyZNEu
Threatray 10'232 similar samples on MalwareBazaar
TLSH T1BD94DF4183ECDB9FE3296A3568193C1086A3C3DD2193DE4AED6944B57DDA24CFB10AD3
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Contract.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-24 10:14:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/107c77d9-1feb-4b7f-9cf9-1fa944fdaf3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191141/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.6649.25149.UNOFFICIAL
Create hunting rule

Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/559844ec-66cd-4538-88ee-c9663f2b0f30
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857282
Signature
.NET source code contains potential unpacker
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 489712 Sample: Contract.exe Startdate: 24/09/2021 Architecture: WINDOWS Score: 100 30 ic-54113400-0ac7b9-windowsupdate48.s.loris.llnwd.net 2->30 32 ic-54113400-0a7b2f-windowsupdate48.s.loris.llnwd.net 2->32 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 5 other signatures 2->50 7 Contract.exe 3 2->7         started        11 DnDcR.exe 3 2->11         started        13 DnDcR.exe 2 2->13         started        signatures3 process4 file5 28 C:\Users\user\AppData\...\Contract.exe.log, ASCII 7->28 dropped 52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->52 54 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->54 56 Contains functionality to register a low level keyboard hook 7->56 15 Contract.exe 2 5 7->15         started        58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 11->60 62 Injects a PE file into a foreign processes 11->62 20 DnDcR.exe 2 11->20         started        signatures6 process7 dnsIp8 34 mail.atlantic-consarves.com 63.250.38.200, 49824, 587 NAMECHEAP-NETUS United States 15->34 22 C:\Users\user\AppData\Roaming\...\DnDcR.exe, PE32 15->22 dropped 24 C:\Windows\System32\drivers\etc\hosts, ASCII 15->24 dropped 26 C:\Users\user\...\DnDcR.exe:Zone.Identifier, ASCII 15->26 dropped 36 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->36 38 Tries to steal Mail credentials (via file access) 15->38 40 Tries to harvest and steal ftp login credentials 15->40 42 4 other signatures 15->42 file9 signatures10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 04:18:48 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcre4ibttatkohqttrkfk35g6y3duxklplursdnjlgz4t4v7uhzq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3aa9edef2af34b3b432e934a41ef138b763cc23dcb8cc35a739cfb5903c1f436
AgentTesla
61060fa22e8fe8c29f2cd7b2b4b9bc4d350fc9331a6dfcbc2f873bec00f6818d
AgentTesla
83f15b501b3027bbd1a397508908e844f35fd620ffe5e7a671145078f3dc88c3
AgentTesla
b18a8dc6d225d963259d1b3547450946822cf8a6e7b62a7cff5705a844cdbcf6
AgentTesla
b786e3919cd022e14e2b733ce3616cc8614dc3d0668f562dbceaa20709fcc36e
AgentTesla
c345fbabcb3e55e64341e860bb2916ba52ddea44257d8fa5b79f2ae7062734c8
AgentTesla
d08222dfb92c317e63590fbe016ab4cd1f462b1aa49ab5760ad6f9f0eaa22f32
AgentTesla
e30e9ec11818e069b23a74a0a47d0a2b91c19556e2851a79c033c2ef0b680974
AgentTesla
fbadf252eb04bc791373500dd2b28c45ef60bf5f34c711c4bff61fe5230c056c
AgentTesla
+ 10'222 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210924-l9765sgfa4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
74b796245fd278d7702612d341cd9d7a6a2c86d0d130fd41df3b36c91089ea5c
MD5 hash:
5d02fcf2ded2882ef3f6593b85209f00
SHA1 hash:
ee54f15652dce3374d0df26d416a5a4ec9c0dae3
Link:
https://www.unpac.me/results/c5d4f8eb-6889-40c9-bee6-06a0ea3cce45/
SH256 hash:
53609245278107f26e31c973eb6c052e68dd287fe686f9c4520cc364f3ca65c4
MD5 hash:
026c7ec67bc5ed626618d80431d26e31
SHA1 hash:
d2e2490038ca11cd5b14e3ef04b4c4a29f45a2c8
Link:
https://www.unpac.me/results/c5d4f8eb-6889-40c9-bee6-06a0ea3cce45/
SH256 hash:
a654e2167651d9cc6382185f54c29f25fee73f81a8a01c628f12e0dd9f0106c7
MD5 hash:
49149698254f4dcd6aa286f2da77245a
SHA1 hash:
bf72b03a65f03b7d6b14d107b59834bc78d084e4
Link:
https://www.unpac.me/results/c5d4f8eb-6889-40c9-bee6-06a0ea3cce45/
SH256 hash:
9576b6178230c0d8d568c7d76e6aab4792bfe87db6e6c36a0bff7f844dea6731
MD5 hash:
74de8f574532780cfdcad50f8fc576bf
SHA1 hash:
38ef83ea7c557988b4bd5ffcb66d15f78b10e3cd
Link:
https://www.unpac.me/results/c5d4f8eb-6889-40c9-bee6-06a0ea3cce45/
SH256 hash:
30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3
MD5 hash:
b40fdde8238ff745c496c7d32f3a9a7b
SHA1 hash:
df7eb0bdeaa6d40fee0ce6dc7628f2db7e816f91
Link:
https://www.unpac.me/results/c5d4f8eb-6889-40c9-bee6-06a0ea3cce45/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/30a24e203398/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 30a24e20339826a71e139c54556fa6f6363a5d4b7ae9190da959b3c9f2bfa1f3

(this sample)

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/191141/

Comments