MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8
SHA3-384 hash: 45e45bb3c032c7895c7a04474246d1352e1a724622b6b67205baea92b871e77131e12e9ba56790f332d8d9611d7b4e73
SHA1 hash: 0063a44d700b7ec7e3b5e3e0604c1dbf12f2f6ed
MD5 hash: 2ad30994e6bed94c627ba4af0d79117a
humanhash: undress-april-blue-carpet
File name:2ad30994e6bed94c627ba4af0d79117a.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'088 bytes
First seen:2021-09-14 08:43:00 UTC
Last seen:2021-09-14 10:12:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:oReEjW90509DBsAow/mwrDAU8AytQT0NqDkH5V7lWfkqKXXLoCYs45A7TkSW9phG:oReEjB0BK5w/m2Lf/DkHPQKKb5AkpG
Threatray 9'809 similar samples on MalwareBazaar
TLSH T16DA4121525FD4773D8EF0BBDA026405617B0DA63E013E34ECFAA61E5190B7D08A26BE7
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2ad30994e6bed94c627ba4af0d79117a.exe
Verdict:
Malicious activity
Analysis date:
2021-09-14 08:49:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a55295b2-bd73-452b-96c5-ca4f3487a5b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187771/
Detection(s):
SecuriteInfo.com.MachineLearning.Anomalous.94.4386.29447.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
monero obfuscated packed
Link:
https://www.filescan.io/uploads/61750e029a5a1e91c5d2010c/reports/5b3ef5ec-cec2-4fd2-966b-92b1d23ab560/overview
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/314788ad-6010-4f8a-83cb-d539236222cc
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850500
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 482931 Sample: kkhjiJsXWo.exe Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 26 clientconfig.passport.net 2->26 32 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->32 34 Found malware configuration 2->34 36 Multi AV Scanner detection for dropped file 2->36 38 4 other signatures 2->38 8 kkhjiJsXWo.exe 7 2->8         started        signatures3 process4 file5 22 C:\Users\user\AppData\...\jarRXBfESXkn.exe, PE32 8->22 dropped 24 C:\Users\user\AppData\Local\...\tmp2EC6.tmp, XML 8->24 dropped 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->40 42 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->42 44 Uses schtasks.exe or at.exe to add and modify task schedules 8->44 46 Injects a PE file into a foreign processes 8->46 12 kkhjiJsXWo.exe 2 8->12         started        16 schtasks.exe 1 8->16         started        18 kkhjiJsXWo.exe 8->18         started        signatures6 process7 dnsIp8 28 gb-promotion.com 192.185.147.20, 49880, 587 OIS1US United States 12->28 30 mail.gb-promotion.com 12->30 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->48 50 Tries to steal Mail credentials (via file access) 12->50 52 Tries to harvest and steal ftp login credentials 12->52 54 2 other signatures 12->54 20 conhost.exe 16->20         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-09-14 08:43:24 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06d4b51b902abbdd0467d07cf37e6ac59a2041cc44daa3d99f67e36ffd630513
AgentTesla
18101c8143fc94452ed21e400ea2fa9842f516a9ceb8b61d600dfa7acb0e3e87
AgentTesla
31feccf3da6fc04933d3ae09ff786132b5690c7f60cc8482f54b968b50a131e2
AgentTesla
7869ecfcf6a7380c9b011d0a7bdb334f0f4d16cba20e3c5533db88c558ff9220
AgentTesla
8ad34fbb0c14831270cefadd9f2d1f66f855cee0c4b37ed407766dc19b75e603
AgentTesla
908bdd0a542953cae5067c4b83a16cb8eade4890a70951f974703d8e3a67b7dc
AgentTesla
9bd0e2f3db2198a11805aedadf2ef3e75aba1c02f1bbe0fe880eb71bb6a2651b
AgentTesla
afb06484356323b7af99b1cc8c732b6f60fcf9e8b1b3a32b06e6e5700e768635
AgentTesla
c72b8203d03b577f7ca65cbec39de14a45c2a82f5d5e799635331480c8754651
AgentTesla
+ 9'799 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210914-kmk8esfdd2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c7b4c0f7bbbbf9ea7e0ac6514106d666d9d7457399e6ccaa51cfddeae1a64a17
MD5 hash:
02a996b81fccc63aee5c54e1d29b1306
SHA1 hash:
ba1f8bd5709bc2bba5b7e353162e82eb53200c23
Link:
https://www.unpac.me/results/cbf803b0-036f-4bbd-99d8-11b2c07daeb8/
SH256 hash:
ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587
MD5 hash:
43ababb6b0a02907aad43084f12b10d9
SHA1 hash:
b60ba705891d5a666d64300181b475a46714ffa8
Link:
https://www.unpac.me/results/cbf803b0-036f-4bbd-99d8-11b2c07daeb8/
SH256 hash:
ede1d7c906304311ed97edc17198a68bc4f03f4120cc2c5a2b3e7a59881ba9d7
MD5 hash:
df4b875b6e1d12cf880272a96a4b0cd9
SHA1 hash:
004d2aab9f0d6a8c5346c5a6af91d7d0a1fc4ab4
Link:
https://www.unpac.me/results/cbf803b0-036f-4bbd-99d8-11b2c07daeb8/
SH256 hash:
30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8
MD5 hash:
2ad30994e6bed94c627ba4af0d79117a
SHA1 hash:
0063a44d700b7ec7e3b5e3e0604c1dbf12f2f6ed
Link:
https://www.unpac.me/results/cbf803b0-036f-4bbd-99d8-11b2c07daeb8/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/30eef17b2025/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 30eef17b2025b700145bcb23d831b0f915ad983d0a555a002d34f6358172a3a8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1601928/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/187771/

Comments