MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c
SHA3-384 hash: 419f5f49150bce8e3a99b0955cd09b128f3d13f5c0e48b27126b3beb86ac5cd74e9f945910571e054fe5ac1595bc5c50
SHA1 hash: 7b3ddf2a111e1363a58ffa1e48c57888d39c4800
MD5 hash: d2ae266c80e8060a3466e937d490a19a
humanhash: hawaii-hawaii-delta-victor
File name:Purchase Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:908'800 bytes
First seen:2020-11-05 17:10:57 UTC
Last seen:2020-11-07 21:37:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:RGUvsfF6CTH6Ht5AYRsQmIwdT908v6/1jG1Pb7ql:3wFEN5AYRHOd28vw1jG1T7q
Threatray 993 similar samples on MalwareBazaar
TLSH 3E15BFFA6246EA5AC80F043FF84B255193D9DB2E99FC904653C5F11D137C6CEA2AC48B
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83336/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42665.15296.24313.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 17:12:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hao5taemz6c6dcf5wvzn3akewga2rosrmcwf2ylri3kckalrc5ga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
37899ec2bb2af9ca237b54707d5e7fdff2618bbe743144f71a3338de8bca2c62
AgentTesla
420964e0ddf92963742717a6101a8a1ba18882ad7187a5cf0b586d717b87dfb7
AgentTesla
4887639a62fab8baa56b119e5f05ec897ff95ec2b03833fc93cdc6a434f704b1
AgentTesla
4f36b4eb0d565ea62c101d519b263f900409c38d769ad365ac85afcd8efa6fa8
AgentTesla
50afd5ece0acec9f47c8ffe0a8ed8f085c0e54d9e02ee058ad34c08ab595f5aa
AgentTesla
86c47856c1763cd1fa746ad990a69b1c3f5c783cdb68b18c9335af1d6b65fbb4
AgentTesla
8bb96bc7a886ac113b6fbbd8c07e7e6629fc695d7558a28cb8b0fa6c77ce9100
AgentTesla
c930deb75ebc8fd117d585898358df69af8ce6ffe9569ef5f47ad9fc6f26d01e
AgentTesla
ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6
AgentTesla
caae4001f524c83a5c3c3b7f7a56d3344d9de742eadbfc54bf3e7fda14354392
AgentTesla
+ 983 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201105-x3qyenag6s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c
MD5 hash:
d2ae266c80e8060a3466e937d490a19a
SHA1 hash:
7b3ddf2a111e1363a58ffa1e48c57888d39c4800
Link:
https://www.unpac.me/results/22ce574f-54a8-4724-ab26-31b8456fa502/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/22ce574f-54a8-4724-ab26-31b8456fa502/
SH256 hash:
ee1374b3d1840e30579de166f8dfe9e7fa80cc1eb6cb363c69c0cc2dc9b43e32
MD5 hash:
79fdbc7dfa9c089dfe922ba394a146fe
SHA1 hash:
7bd2fbe92a560d1d50f7157cf23d886a9075f980
Link:
https://www.unpac.me/results/22ce574f-54a8-4724-ab26-31b8456fa502/
SH256 hash:
22025207c38e98b8ab93ba7c2e4bd8ea00e7e72278a34faf7934fc502eea121a
MD5 hash:
8c0845ffba9bfc054c529051a30691bf
SHA1 hash:
c9295ff47b24864123d0811f348cf265f810ab22
Link:
https://www.unpac.me/results/22ce574f-54a8-4724-ab26-31b8456fa502/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c44820e57806a60ed33e063933118250574b959ed2eaf4c1eb01c6d8296b2a21

AgentTesla

Executable exe 381dd9808ccf85e188bdb572dd8144b181a8ba5160ac5d617146d4250171174c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c44820e57806a60ed33e063933118250574b959ed2eaf4c1eb01c6d8296b2a21
Cape
Cape
https://www.capesandbox.com/analysis/83336/

Comments