MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea
SHA3-384 hash: 5635a8d362c3d39b0013c1fd437769216307df5f479800bfb90154b1e04b83ff9ec4f088695fa770043c553fab5c519f
SHA1 hash: e01d0bcfee588d40313dde889d87ed32ca0396bd
MD5 hash: 48371272508928cd7a444a52d069a0c3
humanhash: connecticut-avocado-summer-moon
File name:Swift copy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'111'040 bytes
First seen:2021-12-08 05:26:56 UTC
Last seen:2021-12-08 13:58:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:FtX6QbxM97i155WadY55AVxUp2xJMMM5XjF20cY8mDjSM6H:hgIW5+xUpLXo0MmXJM
Threatray 13'344 similar samples on MalwareBazaar
TLSH T1A735237F21444172FDA6297ED49F662203FA8E82B592F32D6DBCDE7225017AD18178C3
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Swift copy.exe
Verdict:
Suspicious activity
Analysis date:
2021-12-08 05:30:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cb53d014-ff1d-41da-a857-3a7753e8068f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/212342/
Detection(s):
Sanesecurity.Rogue.0hr.20211208-0608.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Launching a process
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit obfuscated packed
Link:
https://www.filescan.io/uploads/61b0422847ed217c0135600a/reports/12981909-e3c5-471d-b599-a6de3ae9648d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/96eddf58-394b-49c6-9360-e24d80436dc6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/903631
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 536109 Sample: Swift copy.exe Startdate: 08/12/2021 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Yara detected AgentTesla 2->36 38 Yara detected AntiVM3 2->38 40 4 other signatures 2->40 6 Swift copy.exe 3 2->6         started        9 kprUEGC.exe 2 2->9         started        11 kprUEGC.exe 1 2->11         started        process3 signatures4 42 Writes to foreign memory regions 6->42 44 Injects a PE file into a foreign processes 6->44 13 RegSvcs.exe 2 4 6->13         started        18 RegSvcs.exe 6->18         started        20 RegSvcs.exe 6->20         started        22 conhost.exe 9->22         started        24 conhost.exe 11->24         started        process5 dnsIp6 30 scsgroups.com 103.6.196.179, 49856, 587 EXABYTES-AS-APExaBytesNetworkSdnBhdMY Malaysia 13->30 32 mail.scsgroups.com 13->32 26 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 13->26 dropped 28 C:\Windows\System32\drivers\etc\hosts, ASCII 13->28 dropped 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->46 48 Tries to steal Mail credentials (via file / registry access) 13->48 50 Tries to harvest and steal ftp login credentials 13->50 56 4 other signatures 13->56 52 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 18->52 54 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 18->54 file7 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-12-08 05:27:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ji5f3xtskdbt56bn2wkjurqgifamscgusbbhmj7g5nx6uc4gptva._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
32d4179a6d0a551d7028448b7cbea7672bad35df4422670d35e0b1a9f7ad20c2
AgentTesla
4d1e6b617be93859a64b96bcf336cff274c4a0abba9abadfc1d8144101672645
AgentTesla
5c4394371eb274c1b7cd7e866a33d9d03fbeed0e491dbb6b668c6aab1c25a370
AgentTesla
7c04ed79e657827d9ed17fc6f50e51a5818bf9b7db804691dee2470d5371162e
AgentTesla
925c73a3df8d17a05c817d9b19d8dafeeaf208f23de3f8087107372d529076ab
AgentTesla
a96787b4f613154d3a632a7ce26157b0f5cff77f35037e31be965dd6b2ef49f5
AgentTesla
cae83e99c0f43ff07b4ca8965f740e463378e3547323feb5331bb50f8c333873
AgentTesla
e77447a9ebec55ce1989c4fd34165d628cae27456585d84b3d4f977666152983
AgentTesla
+ 13'334 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211208-f5e2xaaff5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
12cffbc328a97a01f46027a65110bfc928a87ea4fb3a3cf3ca5a0b5414977d8d
MD5 hash:
f013bb1e374b8e4f21eda75db0a7cbd8
SHA1 hash:
f31ecaf17aa3040e04ca7758baa5a1411e86d830
Link:
https://www.unpac.me/results/ac26e302-e1af-4da6-9a77-87263c6ed386/
SH256 hash:
64be17db856139cb6cb0e134d2f852e93d5a58d526041455b2da24046a6812d2
MD5 hash:
ff79ecce8a464486bdc6fd4790331114
SHA1 hash:
7db9b9d8319062ff631a5d566cdc9833cfcbd5ee
Link:
https://www.unpac.me/results/ac26e302-e1af-4da6-9a77-87263c6ed386/
SH256 hash:
9cd82dba6c55d901ac7d7007b7a04a30146ad7c297400d44f9d96b90c5ca25d4
MD5 hash:
d9477c36da677507cd33c6eef325d694
SHA1 hash:
330dc88b5041ca9edf57542f5a30c37eef6f11b1
Link:
https://www.unpac.me/results/ac26e302-e1af-4da6-9a77-87263c6ed386/
SH256 hash:
4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea
MD5 hash:
48371272508928cd7a444a52d069a0c3
SHA1 hash:
e01d0bcfee588d40313dde889d87ed32ca0396bd
Link:
https://www.unpac.me/results/ac26e302-e1af-4da6-9a77-87263c6ed386/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4a3a5dde7250c33ef82dd5949a46064140c908d490427627e6eb6fea0b867cea

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/212342/

Comments