MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c
SHA3-384 hash: 00343c7cfec3f987346b90d75c6ae16b8ed6796a150083204703e87e22a584eaf7af35a21c1ee4cf357df50b4b3bd913
SHA1 hash: 90e7139e291042da973aa92e8ad586e6eb0ec32c
MD5 hash: a0381ab509e8f10f002fab29368dfc13
humanhash: april-beryllium-romeo-social
File name:STATEMENT OF ACCOUNT.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'181'120 bytes
First seen:2021-02-02 06:35:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:Jep8J3LzmSrrBg7tgFtSe+e3K+7G4rkd4zhNR+x6cW:4yf5I6J7G4r44zkxj
Threatray 1 similar samples on MalwareBazaar
TLSH 3AA5F6516ADC2F04E43E9B39AA30061547F27947F77AE65E6DC0229A9C367C1AF0D323
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
STATEMENT OF ACCOUNT.exe
Verdict:
Malicious activity
Analysis date:
2021-02-02 06:36:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b84cf37d-e0d8-48f2-ae77-910c75a4696a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/114889/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/596174
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 347126 Sample: STATEMENT OF ACCOUNT.exe Startdate: 02/02/2021 Architecture: WINDOWS Score: 100 57 Found malware configuration 2->57 59 Sigma detected: Scheduled temp file as task from temp location 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 8 other signatures 2->63 7 STATEMENT OF ACCOUNT.exe 7 2->7         started        11 WULRzP.exe 5 2->11         started        14 WULRzP.exe 2->14         started        process3 dnsIp4 41 C:\Users\user\AppData\Local\...\tmp30C4.tmp, XML 7->41 dropped 43 C:\Users\...\STATEMENT OF ACCOUNT.exe.log, ASCII 7->43 dropped 45 C:\Users\user\AppData\...\FCBSTCTazvD.exe, PE32 7->45 dropped 75 Injects a PE file into a foreign processes 7->75 16 STATEMENT OF ACCOUNT.exe 2 5 7->16         started        21 schtasks.exe 1 7->21         started        55 192.168.2.1 unknown unknown 11->55 77 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->77 79 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->79 23 WULRzP.exe 2 11->23         started        25 schtasks.exe 1 11->25         started        27 WULRzP.exe 14->27         started        29 schtasks.exe 14->29         started        file5 signatures6 process7 dnsIp8 47 goldenamoonresorts.com 139.162.21.249, 49692, 49706, 49707 LINODE-APLinodeLLCUS Netherlands 16->47 49 mail.goldenamoonresorts.com 16->49 37 C:\Users\user\AppData\Roaming\...\WULRzP.exe, PE32 16->37 dropped 39 C:\Users\user\...\WULRzP.exe:Zone.Identifier, ASCII 16->39 dropped 65 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->65 67 Tries to steal Mail credentials (via file access) 16->67 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->69 31 conhost.exe 21->31         started        51 mail.goldenamoonresorts.com 23->51 33 conhost.exe 25->33         started        53 mail.goldenamoonresorts.com 27->53 71 Tries to harvest and steal ftp login credentials 27->71 73 Tries to harvest and steal browser information (history, passwords, etc) 27->73 35 conhost.exe 29->35         started        file9 signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 03:14:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
36
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jajpqgeghr6hx6hetlz7cgg6k57tbbb5ggcgtfq6ukmknj25tawa._file
Verdict:
unknown
Similar samples:
865114b9f103c739212beb94ede2a4c67f58b9f02268673109b452452803e88a
AgentTesla
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence ransomware spyware
Link:
https://tria.ge/reports/210202-wg1sh612ga/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
bd03f1419db658015507630078378ed7b24ed480166fb9855308e78cd249fb44
MD5 hash:
06ba0381250a64535e2ff8dcf4f37907
SHA1 hash:
bb9f2a2c1d8bdabeefcb7b1f0333a47ae144571c
Link:
https://www.unpac.me/results/a91e6a1d-3eec-4e62-945a-9068dcc38c4c/
SH256 hash:
85c781d8c4c02419db6cb8d89c5e819023ed229c5d06d5f4052bd3ad0af4ed61
MD5 hash:
3351a58a2c0a6cfb26f720c8889ed948
SHA1 hash:
9586df7a9ee0c71792fa27482f2cd938ecd666f9
Link:
https://www.unpac.me/results/a91e6a1d-3eec-4e62-945a-9068dcc38c4c/
SH256 hash:
56c2d1c51ea776027fd7d3f62ba5a0db2c059b040bf6f0584adcb1299bd29e78
MD5 hash:
3868e1edcd9ee721f05b2daf3b38e548
SHA1 hash:
54aa40c8ebaa85f1d84cbd78095c8e277ceaff9f
Link:
https://www.unpac.me/results/a91e6a1d-3eec-4e62-945a-9068dcc38c4c/
SH256 hash:
4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c
MD5 hash:
a0381ab509e8f10f002fab29368dfc13
SHA1 hash:
90e7139e291042da973aa92e8ad586e6eb0ec32c
Link:
https://www.unpac.me/results/a91e6a1d-3eec-4e62-945a-9068dcc38c4c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e138164ccae1bdb56f73951e306197c9104793ca86b583c5fdafcf6a41541f2b

AgentTesla

Executable exe 4812f818863c7c7bf8e49af3f118de577f30843d318469961ea298a6a75d982c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 e138164ccae1bdb56f73951e306197c9104793ca86b583c5fdafcf6a41541f2b
Cape
Cape
https://www.capesandbox.com/analysis/114889/

Comments