MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b
SHA3-384 hash: 044e45f646b1589b634309a23ba79a1887d8db76e0e83aebc8121d769b949c2680a292f6ce7cf1e26b8adfb366a24799
SHA1 hash: ebb148f820e57558a92195650dbd5acd1fc53506
MD5 hash: 980d3ae3e8147602660a50dcb772a28a
humanhash: hawaii-magazine-twelve-cola
File name:QUOTE FOR NEW SHIPMENT.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:708'608 bytes
First seen:2021-08-26 11:20:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'751 x AgentTesla, 19'657 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:F0iLbQ8w6Lv4mmaMMnuYdvO8we5yIuEwr0PF8SZUDgI1VXiIgSwNU:ai3dfLy9JYlPdyIuEwr0PufSIvwNU
Threatray 8'965 similar samples on MalwareBazaar
TLSH T153E4BF87720178DFEAA2A83FBAC9CC74D53495ADD283D20650872F97FC5C642CE065E9
dhash icon a2c4d4d4d4e8f086 (2 x AgentTesla)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTE FOR NEW SHIPMENT.exe
Verdict:
Malicious activity
Analysis date:
2021-08-26 11:23:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2abd62a7-2b13-40ec-ba6c-e8ae34f5eb2a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/182583/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/55027a88-1a0a-426f-a6b5-a5c32b312cf6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/839674
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 472105 Sample: QUOTE FOR NEW SHIPMENT.exe Startdate: 26/08/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 7 other signatures 2->51 7 QUOTE FOR NEW SHIPMENT.exe 6 2->7         started        11 tKZVPq.exe 2 2->11         started        13 tKZVPq.exe 1 2->13         started        process3 file4 27 C:\Users\user\AppData\...\iPadpIHyQsdWWs.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\Local\...\tmp5ECC.tmp, XML 7->29 dropped 31 C:\Users\...\QUOTE FOR NEW SHIPMENT.exe.log, ASCII 7->31 dropped 53 Writes to foreign memory regions 7->53 55 Injects a PE file into a foreign processes 7->55 15 RegSvcs.exe 2 4 7->15         started        19 schtasks.exe 1 7->19         started        21 conhost.exe 11->21         started        23 conhost.exe 13->23         started        signatures5 process6 file7 33 C:\Users\user\AppData\Roaming\...\tKZVPq.exe, PE32 15->33 dropped 35 C:\Windows\System32\drivers\etc\hosts, ASCII 15->35 dropped 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->37 39 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->39 41 Modifies the hosts file 15->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->43 25 conhost.exe 19->25         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 05:26:38 UTC
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gogpknxqfec7x6yj4ap7nql6hnrfc7h2lhmwdnqm5yzkanqp7knq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0dea09c30d8e850fab893b3f17f9bad6898c7e77bb690ecfe523681ca0f07e95
AgentTesla
15a5b08b916245fd666e172d308831ef96e4c68b63c9a0c57aa9b83519ebbf35
AgentTesla
6c774012ef6641580ad729f00e565e5ab5a13e7eeca97b510f2e2e9e101b9375
AgentTesla
71e6c949b0e259018b39ad513305c9197afe74c9d68119db8e6e545c74ceedcb
AgentTesla
9662d1e4c72efe73a1f203ebead6069990342a4da6314737e3a02b08e2d68075
AgentTesla
a3aa3605c436f4ef38f404007ce0305562def1f6e77f244232671b10914894f0
AgentTesla
da33725694fafe69b0a72478a9741ae2eac9d294966f160204a93e27f711b514
AgentTesla
deeb5dcdd0c7e025bcc044147c0d3c8b959cb791a169a9d57a02162353362a9c
AgentTesla
+ 8'955 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210826-pmw3dyqw4s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/27f2627b-7c1d-438c-ac7b-0ee3e62a662a/
SH256 hash:
c347a43d8bd9fecd394621c878a4a87312ab3f190b7e047fa4a45077479d9a9b
MD5 hash:
7618e222cf97035ead5b8f9a3264455f
SHA1 hash:
78ac711912f6b11f56207e6d1732af5635dc4c0a
Link:
https://www.unpac.me/results/27f2627b-7c1d-438c-ac7b-0ee3e62a662a/
SH256 hash:
52e1f01462b5684ac426f6715e76cfb4c4ab91af44ed7843f17c4cb92c689e75
MD5 hash:
94bca95d17017e0ab3563f9980985645
SHA1 hash:
248e27e9fd4acaea245b715cedfbea7ba6110888
Link:
https://www.unpac.me/results/27f2627b-7c1d-438c-ac7b-0ee3e62a662a/
SH256 hash:
338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b
MD5 hash:
980d3ae3e8147602660a50dcb772a28a
SHA1 hash:
ebb148f820e57558a92195650dbd5acd1fc53506
Link:
https://www.unpac.me/results/27f2627b-7c1d-438c-ac7b-0ee3e62a662a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/338cf536f029/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 338cf536f02905fbfb09e01ff6c17e3b62517cfa59d961b60cee32a0360ffa9b

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/182583/

Comments