MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa
SHA3-384 hash: 833bee110d5868bd77494db91d6a3988d11d2902d532c6e283341fdf857eedfb5678868b2714995e37154ef41acc62ed
SHA1 hash: 8688e21feb914500f2bfe6365a8a91a8919b6b95
MD5 hash: 0c0a8988511c16dc0516803d6398fd3b
humanhash: glucose-friend-dakota-early
File name:invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:690'176 bytes
First seen:2022-06-15 11:33:47 UTC
Last seen:2022-06-15 13:01:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:iFsItm9fUiVczBOHKw1b1RNkuMlppTTvQGnXXNsvOmAzro:P9fWVOFb1RNkuMvhQGnXd9br
Threatray 17'937 similar samples on MalwareBazaar
TLSH T16EE4D004BA67CE06D1A57737C1D60D1467F8AD42A16AEB4FBBC722D88D033EA481275F
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
286
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/280143/
Detection(s):
SecuriteInfo.com.Variant.Tedy.140728.18390.31813.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62a9c3e973b91c38f691eea2/reports/7df4717e-b5d5-49b7-8b1b-093732b28c34/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f2c14d10-5323-4ebc-ae4c-7acb045d2aa7
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1013623
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 646120 Sample: invoice.exe Startdate: 15/06/2022 Architecture: WINDOWS Score: 100 62 Snort IDS alert for network traffic 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for dropped file 2->66 68 8 other signatures 2->68 7 invoice.exe 7 2->7         started        11 Tnpak.exe 2 2->11         started        13 Tnpak.exe 2->13         started        process3 file4 38 C:\Users\user\AppData\...\lTFOvXEwzew.exe, PE32 7->38 dropped 40 C:\Users\...\lTFOvXEwzew.exe:Zone.Identifier, ASCII 7->40 dropped 42 C:\Users\user\AppData\Local\...\tmp7F7F.tmp, XML 7->42 dropped 44 C:\Users\user\AppData\...\invoice.exe.log, ASCII 7->44 dropped 70 Uses schtasks.exe or at.exe to add and modify task schedules 7->70 72 Writes to foreign memory regions 7->72 74 Adds a directory exclusion to Windows Defender 7->74 76 Injects a PE file into a foreign processes 7->76 15 RegSvcs.exe 2 4 7->15         started        20 RegSvcs.exe 7->20         started        22 powershell.exe 24 7->22         started        24 schtasks.exe 1 7->24         started        26 conhost.exe 11->26         started        28 conhost.exe 13->28         started        signatures5 process6 dnsIp7 46 subnet-group.com 206.189.39.129, 49791, 587 DIGITALOCEAN-ASNUS United States 15->46 48 mail.subnet-group.com 15->48 34 C:\Users\user\AppData\Roaming\...\Tnpak.exe, PE32 15->34 dropped 36 C:\Windows\System32\drivers\etc\hosts, ASCII 15->36 dropped 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->50 52 Tries to steal Mail credentials (via file / registry access) 15->52 54 Tries to harvest and steal ftp login credentials 15->54 60 3 other signatures 15->60 56 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->56 58 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->58 30 conhost.exe 22->30         started        32 conhost.exe 24->32         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2022-06-15 10:33:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyno7iqcs3uuqcd4acgfibxjco4qjarloii4hg3hduxsalonlh5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
046b8e8b86542500b837c04d771062d242811e2bb96ffc45c6556bd4e3cdea4c
AgentTesla
7df2d256518cec4656c0ab236d2b26e2d7976382ab75eb0326b5b8c463a6821d
AgentTesla
af2acd41db7481f03a6646e86518d18a8625e4d3d69d5c02f5698c6e95c43b32
AgentTesla
d3817d4e0e6fec28d66ca03c2e37a9bdc79813d3dd8c14889b539d2a5d53e7e2
AgentTesla
d4f545324d12cabda6b75732268a2ef5c635917ba49469cabd8dfba7f202e6c7
AgentTesla
d8fb0f57ebd4dc27d230b65b213f60217492438cdbf2aaad4e6d6a14a1f17cc5
AgentTesla
+ 17'927 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/220615-npfmhahba7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops file in Drivers directory
AgentTesla
suricata: ET MALWARE AgentTesla Exfil Via SMTP
Unpacked files
SH256 hash:
5e95b92999dc337f367d2c8e91e68daadbcdfc537d2d11fa2612ce68a58e8d04
MD5 hash:
e3df2dd40f0ce5dcd593a52653983ca4
SHA1 hash:
d7d895a35867dc41c8a03ab5ec3aa4e38e1a08a3
Link:
https://www.unpac.me/results/979f6f3a-026a-4fb3-a79c-f5830caa1ef7/
SH256 hash:
cf7abd76bb409d4e1388ad1adbd57ff69349e2aa0b31178479de0ab4f002320f
MD5 hash:
32e00c8d0500cc810105144604ea090c
SHA1 hash:
7d461c26fdcc2550718efee7c15c3590f1fb5de6
Link:
https://www.unpac.me/results/979f6f3a-026a-4fb3-a79c-f5830caa1ef7/
SH256 hash:
8eea34761755bde6873f711d42e0cea8c3a08b702c192fb02749c0a6af01c7ec
MD5 hash:
41e199eb276a7ead0799dbf2948af888
SHA1 hash:
58e52db4474a979245a79d8f7686eff2f7be6f5f
Link:
https://www.unpac.me/results/979f6f3a-026a-4fb3-a79c-f5830caa1ef7/
SH256 hash:
7f931b7314417f25d0c1c932ea9683252367858893b3f5936572a6700238ffdd
MD5 hash:
71dd9ac5ab45f50350958a51c39d2cbd
SHA1 hash:
1dd97a7f6fb28509f6435d9a981811afbcbbe3f9
Link:
https://www.unpac.me/results/979f6f3a-026a-4fb3-a79c-f5830caa1ef7/
SH256 hash:
361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa
MD5 hash:
0c0a8988511c16dc0516803d6398fd3b
SHA1 hash:
8688e21feb914500f2bfe6365a8a91a8919b6b95
Link:
https://www.unpac.me/results/979f6f3a-026a-4fb3-a79c-f5830caa1ef7/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/361aefa20296/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 361aefa20296e948087c008c5406e913b904822b7211c39b671d2f202dcd59fa

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/280143/

Comments