MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa
SHA3-384 hash:	d487bb5684144d296d156ef39a074c1a7659fff2651eee22652fdafbac9321baa59236369fadfae807fe11a08a027998
SHA1 hash:	e391ed433562ffd9c16f252d20cef858618aa138
MD5 hash:	68dc4540599e43d1c4845cec480aac3b
humanhash:	india-alanine-hot-wyoming
File name:	Quotation_pdh.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	807'424 bytes
First seen:	2020-08-10 09:27:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ce9dc34dcdc6dcac1abc92d3ec049de7 (11 x AgentTesla, 4 x MassLogger, 2 x FormBook)
ssdeep	12288:TQoTCHdOasekxlSBWq6UDb9BxgMBFGCeR7HDg1NwTfpSBrOogf+z:M4UOaeCWal93GVRLy+ThSVOo8+z
Threatray	11'877 similar samples on MalwareBazaar
TLSH	CA05AE26E1E04833F367D63F9C1B56679825BED32A2869452BE45C484F397B03C252BF
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: calcium.cloudhosting.co.uk
Sending IP: 77.72.0.154
From: info@commercialledlightinginstallers.uk
Subject: REQUEST FOR QUOTATION!!
Attachment: Quotation_pdh.gz (contains "Quotation_pdh.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/42594/

Detection(s):

Win.Dropper.Smdd-6956905-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the process to change network settings

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Sending a UDP request

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/416620

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Capture Wi-Fi password

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to steal Mail credentials (via file access)

Uses netsh to modify the Windows network and firewall settings

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2020-08-10 08:05:52 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ggwwxvrvixc7owmcrcqzluwnpjeiygm32cpohnok5omglt4vq35a._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

298e36ccbf66428cba5cf385f3bb33d4c807aa707ff06d66869e7d584b3e5287

AgentTesla

6cf454ec0892e0367356ae674e93612f1c23d9c99874d8ff7de7d77055cbf9c6

AgentTesla

903d75d1676e90dbe26dfd79c6fa865dc2e53a40e3190b4dd76b260ad608b555

AgentTesla

9bce611301f45b690f323467856374363983aa4c428c1e3cdb763f6e299bb419

AgentTesla

a6df90a24c8100b2ce198b1d3aee1f5bc78d6ab846911a58a0183f4c72912217

AgentTesla

a9abad7f4aace35de5651f437a83f47787606345d04ea63426db6a7a9b02ba5e

AgentTesla

b1de8cf2d588ceb071c2549d61bec4724abffc886a42042268fdbfa9215a774b

AgentTesla

b3a27e158356620e607a47b1ec0ba508a7526d6dcda53de87a40f0e9c5397cc2

AgentTesla

da1be039f11d0a25904fba123afca2656f7f4a423526b2b5c8780315e1053b5c

AgentTesla

+ 11'867 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

upx keylogger stealer spyware persistence trojan family:agenttesla

Link:

https://tria.ge/reports/200810-szb97hhhvj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Modifies service

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

UPX packed file

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar