MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d
SHA3-384 hash: 3ae86232eafd81616b4efffadc291476c4bd157118291676c86a6e0bb4b69be6cc354237b9128256b4fb809a4e69fc42
SHA1 hash: 698cea0f6932132eb83daddeb32294868cdeb02b
MD5 hash: afc4a137e6540e60e063447df2e0a01a
humanhash: hot-fanta-lamp-uncle
File name:PO_DEA657-ARFT-HD510.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:927'744 bytes
First seen:2021-08-24 08:17:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:2trOrQsTXplSzry4mkdne67xKWZiTWkOFg:kryQsrplSzrL1K9TWk
Threatray 8'821 similar samples on MalwareBazaar
TLSH T1FE158C7063C9C294EC1A8FF0126CF79102F235E7B6C5CD6A1ADA724CCE5E9D1260769B
dhash icon c8e4c2d1f5349c09 (15 x AgentTesla, 12 x Formbook, 8 x SnakeKeylogger)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO_DEA657-ARFT-HD510.exe
Verdict:
Malicious activity
Analysis date:
2021-08-24 08:18:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bc71b7cc-1116-40c4-baa8-97bbd735357f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181785/
Detection(s):
SecuriteInfo.com.MachineLearning.Anomalous.96.140.32375.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/73671b97-36f3-4179-92d2-2cad6a6be878
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/838081
Signature
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 470508 Sample: PO_DEA657-ARFT-HD510.exe Startdate: 24/08/2021 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected AgentTesla 2->40 42 6 other signatures 2->42 7 PO_DEA657-ARFT-HD510.exe 7 2->7         started        process3 file4 28 C:\Users\user\AppData\Roaming\BhKtTeSL.exe, PE32 7->28 dropped 30 C:\Users\...\BhKtTeSL.exe:Zone.Identifier, ASCII 7->30 dropped 32 C:\Users\user\AppData\Local\...\tmp3AC3.tmp, XML 7->32 dropped 34 C:\Users\...\PO_DEA657-ARFT-HD510.exe.log, ASCII 7->34 dropped 44 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->44 46 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->46 48 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->48 50 3 other signatures 7->50 11 PO_DEA657-ARFT-HD510.exe 7->11         started        14 powershell.exe 24 7->14         started        16 powershell.exe 24 7->16         started        18 2 other processes 7->18 signatures5 process6 signatures7 52 Moves itself to temp directory 11->52 20 conhost.exe 14->20         started        22 conhost.exe 16->22         started        24 conhost.exe 18->24         started        26 conhost.exe 18->26         started        process8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 08:11:50 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyytyl63rexdmwye3jcuaxbgxbj72gksgee2wadbmnviqz4h3a6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3f584a0e45a98791e456118d425aed123eab4e8b6c053ff608c48e19da9a59c6
AgentTesla
451e9ec4050240af48536c6f5620741555304a2f5d0524c53a559711434a2de3
AgentTesla
5b27b810965060c9aa955425b2fdc1bfa682f8bdd56cf8fdfca2e614bea5d7a9
AgentTesla
5f7796b2f2382f8541c0aad659492a4d5b27ad874d92e1bf6f2ee6d864160269
AgentTesla
63aa4b94125d5fd5621d354452e7f547b5937d099f3b92e1fc111f06136611fe
AgentTesla
6faef4e15fcae0545cbb7cdbb4200f4dcf7c18cdf12b072c65d779acef7d2092
AgentTesla
e9910e5698751eadaa69204411cd4cfe896148b60e71687ab0bd741e790d0488
AgentTesla
f7bc62b2539ceb2b1364cd85ef6544c4063362fa8853c92d12bca41bc290b1d9
AgentTesla
f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
AgentTesla
+ 8'811 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210824-7nqvn57xj2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
6912e4bedd1288f116e968f0a79d9797f6d6bd24d45a5f10c52e20f9d33b8c61
MD5 hash:
03bde4a82ad64c0f314985232fbca3fa
SHA1 hash:
e8d0b6339e94192eaaca32c812f914e60576dca6
Link:
https://www.unpac.me/results/7ef3e2b7-966c-4946-b88c-fdc6540eabf1/
SH256 hash:
28658494489b02e56e125545be7ebf5fadcdd4da91fc9af1b595e9352273d18c
MD5 hash:
e9a006ce6b990a910dcf060026bd16af
SHA1 hash:
cc42789834f4470f2706657fbf6929b028e201b3
Link:
https://www.unpac.me/results/7ef3e2b7-966c-4946-b88c-fdc6540eabf1/
SH256 hash:
f9ec4168518229c5cd324c77ac9519c8eaee755330bf82e54cb6934f4a1fc3b6
MD5 hash:
a94288c5dedd81ec956601b2c45bc6fa
SHA1 hash:
70088e1a54e2d4d02da46446f0427322271517da
Link:
https://www.unpac.me/results/7ef3e2b7-966c-4946-b88c-fdc6540eabf1/
SH256 hash:
36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d
MD5 hash:
afc4a137e6540e60e063447df2e0a01a
SHA1 hash:
698cea0f6932132eb83daddeb32294868cdeb02b
Link:
https://www.unpac.me/results/7ef3e2b7-966c-4946-b88c-fdc6540eabf1/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/36313c2fdb89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 36313c2fdb892e365b04da45405c26b853fd19523109ab0061636a886787d83d

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/181785/

Comments