MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6
SHA3-384 hash: 24134cac4b7b9f72156915ebc13f112e3926e957c5269f5a41607e9085bd4a2a051e949f327b15c6cc449beffe0308dd
SHA1 hash: 2ecbe5de53a94cc002c7b6c7e2a5168d1976fba3
MD5 hash: 7edf6f22713e83b38f8374f705695cff
humanhash: pasta-mars-early-failed
File name:SecuriteInfo.com.Trojan.GenericKD.34998567.15564.5609
Download: download sample
Signature AgentTesla
Create hunting rule
File size:391'680 bytes
First seen:2020-11-02 20:48:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:R4R7MJGtlE5XUFcgs82SLGDibbGJLs/k3:o7MJYOmcH8rtbbGJLJ
Threatray 950 similar samples on MalwareBazaar
TLSH 2F842903B7058B55C5A07BB702B5BE5DA352F5CBB7418F0E130FC63959A3AC9AE0E648
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/81877/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34998567.15564.5609.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Creating a file in the Program Files subdirectories
Launching cmd.exe command interpreter
Creating a process from a recently created file
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/518617
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 308412 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 02/11/2020 Architecture: WINDOWS Score: 100 42 Multi AV Scanner detection for dropped file 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected AgentTesla 2->46 48 5 other signatures 2->48 8 SecuriteInfo.com.Trojan.GenericKD.34998567.15564.exe 4 2->8         started        12 prgram.exe 2 2->12         started        process3 file4 34 SecuriteInfo.com.T...98567.15564.exe.log, ASCII 8->34 dropped 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->60 14 cmd.exe 1 8->14         started        16 cmd.exe 2 8->16         started        19 prgram.exe 15 2 12->19         started        signatures5 process6 dnsIp7 23 prgram.exe 4 14->23         started        26 conhost.exe 14->26         started        32 C:\Program Files (x86)\prgram.exe, PE32 16->32 dropped 28 conhost.exe 16->28         started        36 elb097307-934924932.us-east-1.elb.amazonaws.com 54.243.161.145, 443, 49750 AMAZON-AESUS United States 19->36 38 192.168.2.1 unknown unknown 19->38 40 2 other IPs or domains 19->40 50 Tries to steal Mail credentials (via file access) 19->50 52 Tries to harvest and steal browser information (history, passwords, etc) 19->52 54 Installs a global keyboard hook 19->54 file8 signatures9 process10 signatures11 56 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->56 58 Injects a PE file into a foreign processes 23->58 30 prgram.exe 2 23->30         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 03:28:13 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gugqnerfznj3ydbxmlnfzqlq5lbhg4yyg556cqnfjblfceczct3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09039ff8c6c08c31f158428d4f78123e5afc57f0751ab877d84011897c512f1d
AgentTesla
1a45a42350aab874f77e01018c157f7268e78765802ca0e042d44dbc2e039f8f
AgentTesla
63adb2924e560b5372169c820684773bba83fe0ab3e0b51ecf3192b0cda9d774
AgentTesla
7776a27b260441d31741e61d848fb4d4813c75f560d9c9c00d558187d68a009a
AgentTesla
99e683680f3f8272b6c3d7d173e7f942c2747336ba3c6e729e00e9d15b743ec7
AgentTesla
b11b28c7a0565ed2432dab9ef3c10d669c1ecacae72937e01d66ed36bd8c7262
AgentTesla
d5760d2037907e68f8337d7e9d48834c47934946bd71cfaaf8475d3866707509
AgentTesla
d5fa02045d60d623dacb74b1a719e571982f6a68ea7781c06f8d0ce104b98bd6
AgentTesla
dc6a499c7c08de87d5d986fbaf33a59debbc355d00b04d69f340d6d7c346e98d
AgentTesla
ef91cdf4d2ae2a3dd427b89bf9a2e057ec1f6308aba537b7d808e999bb9815f8
AgentTesla
+ 940 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201102-7rgnsmzptj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6
MD5 hash:
7edf6f22713e83b38f8374f705695cff
SHA1 hash:
2ecbe5de53a94cc002c7b6c7e2a5168d1976fba3
Link:
https://www.unpac.me/results/30e28982-70a9-4889-b424-9fa2f3237da2/
SH256 hash:
4f690f3cf792f24a571f09740cf25d0979bde8c11180a26864056643c30479cd
MD5 hash:
304cc4a1948539064cfec5b70bd83e21
SHA1 hash:
32b3754f52323fd71b8349f01c9dd4bc4fecd880
Link:
https://www.unpac.me/results/30e28982-70a9-4889-b424-9fa2f3237da2/
SH256 hash:
542282ed737d2cb55e3cb59d05e58e8dbf6473d63461194a9ba597f0f3eb5d75
MD5 hash:
0ab09caf48c9dcbcbd53aef80493abd2
SHA1 hash:
fd985c8ed98d443fde035be26592b92662b9c5ea
Link:
https://www.unpac.me/results/30e28982-70a9-4889-b424-9fa2f3237da2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 350d069225cb53bc0c3762da5cc170eac2737318377be141a5485651105914f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/780169/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/81877/

Comments