MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3df7f5b80ddcfcddd7c2a5fc2e64ccfb8467b0892ab6c5315906ec5d03cb8a72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3df7f5b80ddcfcddd7c2a5fc2e64ccfb8467b0892ab6c5315906ec5d03cb8a72
SHA3-384 hash: 01263da159d46b07bfaaf730a52f6bf1f986e8666229d84d03fb1add4e27daff2d337dd015ebcda4057b96ada2f32b9a
SHA1 hash: b9bdd436529785649828beba2538a72045766362
MD5 hash: ea7725c2150df4346104fdf547e40f72
humanhash: lemon-delaware-potato-thirteen
File name:soa1.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:496'640 bytes
First seen:2020-12-21 14:11:26 UTC
Last seen:2020-12-21 15:47:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 942da41a3b82835100db145987e7835a (2 x SnakeKeylogger, 1 x AgentTesla)
ssdeep 12288:/xUCd6yXxF0t7dA1o/vmjUejY0vqonpLKJZWpdMs:pv8yBFkJAC/vwUCqoyZWrMs
Threatray 1'929 similar samples on MalwareBazaar
TLSH 9BB4D0D1E78588D5F832007C29AB9CB1264BBC7EE4A00A5B34E67D1568B67C370B7D4B
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.6440.19934.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Unauthorized injection to a recently created process
Creating a window
Launching a process
Sending a UDP request
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/567411
Signature
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 332787 Sample: soa1.exe Startdate: 21/12/2020 Architecture: WINDOWS Score: 80 35 Multi AV Scanner detection for dropped file 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected AgentTesla 2->39 41 3 other signatures 2->41 8 soa1.exe 2 2->8         started        process3 file4 21 C:\Users\user\AppData\Local\Temp\...\file.exe, PE32 8->21 dropped 43 Maps a DLL or memory area into another process 8->43 12 soa1.exe 2 12 8->12         started        signatures5 process6 process7 14 iexplore.exe 1 54 12->14         started        process8 16 iexplore.exe 32 14->16         started        19 iexplore.exe 66 14->19         started        dnsIp9 23 avatars3.githubusercontent.com 16->23 25 avatars1.githubusercontent.com 16->25 27 140.82.121.3, 443, 49745, 49746 GITHUBUS United States 16->27 29 avatars3.githubusercontent.com 19->29 31 avatars1.githubusercontent.com 19->31 33 2 other IPs or domains 19->33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3df7f5b80ddcfcddd7c2a5fc2e64ccfb8467b0892ab6c5315906ec5d03cb8a72/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2020-12-20 21:52:40 UTC
File Type:
PE (Exe)
Extracted files:
17
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hx37loan3t6n3v6cux6c4zgm7ocgpmejfk3mkmkza3wf2a6lrjza._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
38cf806ecaf30b5209ebce1a41e7ac877d3201cec05f4a665fe85797a7069bbc
AgentTesla
3f4689ec7f18f1c30786b9953ed1fccb79f806a233aeb730fff83b432adf87bf
AgentTesla
428b4819734a979d5685b235d190ab9e07bfd6e5098e22ee9195cd386dc701d0
AgentTesla
4d302b4fd8564f5e3f9b505c0f342ec0e133fca6e5d0c6b3bd89746351561c5b
AgentTesla
7b7f6b3a38933a9d06d6315b89df48c695b7ee7e35725649572a4abd17c3496c
AgentTesla
9634cf79c1254f6eb68967cc89267c50513f9df930c15bdcc77bbd1fa1b5add6
AgentTesla
a51bd84d3facb55aaa7d351f79a6383f50b362c48a7abf373675aedd13aa9770
AgentTesla
af1ce5c2a758843b6812b25d3f7646fe186575c7b06510cf8fdbcbe1f827c0c9
AgentTesla
dff521eb1bc7abe5eb779280c5d17c95310be7352ce5927c2173bf1d91a6ca97
AgentTesla
fad59266b34827f994eba36a030a5abd4c552c3132801afec5fe74c787e10044
AgentTesla
+ 1'919 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201221-rncvpl5zsj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
3df7f5b80ddcfcddd7c2a5fc2e64ccfb8467b0892ab6c5315906ec5d03cb8a72
MD5 hash:
ea7725c2150df4346104fdf547e40f72
SHA1 hash:
b9bdd436529785649828beba2538a72045766362
Link:
https://www.unpac.me/results/1b679602-09f4-4bd1-935a-7189fbebd446/
SH256 hash:
f0211e8781298a2e49374b3ec7e974a4284fc81ee973f20048878f7eee5bbd3c
MD5 hash:
f146f8886a46ac780f8d2bbe523b33e5
SHA1 hash:
eed0314eb61643274550346b13efbcc0ee7cafd9
Link:
https://www.unpac.me/results/1b679602-09f4-4bd1-935a-7189fbebd446/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3df7f5b80ddcfcddd7c2a5fc2e64ccfb8467b0892ab6c5315906ec5d03cb8a72

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments