MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759
SHA3-384 hash: 59451dd5117193a631cb6117130b26aa62fab3b8b55c27cdd4cf45e882e312e5960cd7bd868c414ac0714bf92269332d
SHA1 hash: 02c2a7103d805447c3f01200d3c290f54e8c340a
MD5 hash: b3c753827da2442e76c25168939765ae
humanhash: paris-thirteen-earth-black
File name:b3c753827da2442e76c25168939765ae
Download: download sample
Signature AgentTesla
Create hunting rule
File size:935'936 bytes
First seen:2022-03-01 18:58:23 UTC
Last seen:2022-03-01 20:39:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:5zvdomFHxkzkozcFOm4/Ad+pZKLM+A+f1fP7m0+0cGF7PVADPR0OHTgI1+Aim72w:XoEHuzxAd0UL/A+5j20UTgINi
Threatray 15'937 similar samples on MalwareBazaar
TLSH T1E915BF4835D2607DE836CBB2CAC4EFE0DB2AF272D54960B650020E19564DBBD8E45EFD
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/245976/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.35304.19069.24499.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/621e6d04b94fb38cb430f51a/reports/901212a9-49c7-4a28-bbb4-29224c434514/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f27198e8-34b8-43ce-bc55-ce8f08f563d3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/948525
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Sigma detected: Suspicius Schtasks From Env Var Folder
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 581004 Sample: 5pkelbmCRb Startdate: 01/03/2022 Architecture: WINDOWS Score: 100 31 store-images.s-microsoft.com 2->31 33 Found malware configuration 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 12 other signatures 2->39 8 5pkelbmCRb.exe 7 2->8         started        signatures3 process4 file5 23 C:\Users\user\AppData\Roaming\XIfktRgE.exe, PE32 8->23 dropped 25 C:\Users\...\XIfktRgE.exe:Zone.Identifier, ASCII 8->25 dropped 27 C:\Users\user\AppData\Local\...\tmp44AC.tmp, XML 8->27 dropped 29 C:\Users\user\AppData\...\5pkelbmCRb.exe.log, ASCII 8->29 dropped 41 Uses schtasks.exe or at.exe to add and modify task schedules 8->41 43 Writes to foreign memory regions 8->43 45 Adds a directory exclusion to Windows Defender 8->45 47 Injects a PE file into a foreign processes 8->47 12 RegSvcs.exe 2 8->12         started        15 powershell.exe 21 8->15         started        17 schtasks.exe 1 8->17         started        signatures6 process7 signatures8 49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 12->51 19 conhost.exe 15->19         started        21 conhost.exe 17->21         started        process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-01 18:59:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
057829405c326876f0dfff1b3242e845a539fbe24fa5518dbee764adf7910fd8
AgentTesla
2d31d4b70c99a9be8ea02ebeedc419827e44569d3bd835bdfe29b46b89c99a1f
AgentTesla
664dbf2d835736eefd6e7c4400474b27c7d1968444685b7f86843b129d35b6f0
AgentTesla
6d3deba9b84a0196b94370ee9a1201893fcacacc6736638407d0c4b11b7995a2
AgentTesla
704bd3f6c7d6671e896d71bc871f415cfc78209ae32cc518e95e39e7c06f83ad
AgentTesla
9a44a213fb10bc7c0a49c89fd1274d80a4d90dbc328b38d7f1bd9db9c4b3dd4c
AgentTesla
acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376
AgentTesla
b86905276e81077e6f84b256d57ec516f3f458b427f5a015088e56a11f9553cd
AgentTesla
c9af30b2a800c774844eee76e019d10b72c4637adbccd34a6de3bcc8a4f32ba4
AgentTesla
e020e3dfac7560a591909a7f03724657e2037d1cb6cb9f6be27099e10951f5bf
AgentTesla
+ 15'927 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220301-xm3tpacgfp/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
18c7b76b3528710e5c58e23ec44666e4956df79b015770becf072f3ac656cd56
MD5 hash:
0eecf5a6b607ec75187488898a45fb57
SHA1 hash:
b03cf6d47659ea1ecbf8c8bbbef8401508d89e1c
Link:
https://www.unpac.me/results/0414c06a-daaa-48d3-9d3c-23a42a2e5019/
SH256 hash:
1eaf62e469fa044a9dc7df1cd10b04c2e54b113a0ecee9ecdd0b9b2d43598c0b
MD5 hash:
25fe2d67bfdefbc8903a9bde1b1857d0
SHA1 hash:
8794a64a5ddcea78686a53b1f2db949e7f24e77e
Link:
https://www.unpac.me/results/0414c06a-daaa-48d3-9d3c-23a42a2e5019/
SH256 hash:
c6ac415df53fa4b2179c286fb4396e1f6a6d1ace6d3473a2de9597340e9a5f16
MD5 hash:
d63e4e9ec6fd274218997bf5d1152894
SHA1 hash:
874aae2563ef073540774b2ae526ca09d702d7ce
Link:
https://www.unpac.me/results/0414c06a-daaa-48d3-9d3c-23a42a2e5019/
SH256 hash:
e3bdaf9e98eb65a070cf4424bc123e57ade151c41e4a0d375e769749155c1715
MD5 hash:
78a25e75b94923e889ecd100349facbe
SHA1 hash:
6b3f8db525d3c98f92ed480e664ab8ee9458340b
Link:
https://www.unpac.me/results/0414c06a-daaa-48d3-9d3c-23a42a2e5019/
SH256 hash:
45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759
MD5 hash:
b3c753827da2442e76c25168939765ae
SHA1 hash:
02c2a7103d805447c3f01200d3c290f54e8c340a
Link:
https://www.unpac.me/results/0414c06a-daaa-48d3-9d3c-23a42a2e5019/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/45d8ade4dbb0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2069206/
Cape
Cape
https://www.capesandbox.com/analysis/245976/

Comments


Avatar
zbet commented on 2022-03-01 18:58:26 UTC

url : hxxp://198.23.251.3/780/vbc.exe