MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e0f1a66466311d8610b4610fc7ce3c8ea4bb8b71528035cbe3ff2204c3dacd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e0f1a66466311d8610b4610fc7ce3c8ea4bb8b71528035cbe3ff2204c3dacd3
SHA3-384 hash: dfe5ce022e44168ffdd8e63a3b3e7f65cb8a0dd410aebf4ac542ec695dc75d91dc20c911b7d419979996c784d6378ef5
SHA1 hash: 01ec13c0846a5c14af12f5d1bd4f036d788c7908
MD5 hash: 6c7ce45c08313b048b5749e1d0869b4f
humanhash: speaker-nebraska-social-high
File name:90720.PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:900'608 bytes
First seen:2020-11-05 14:34:16 UTC
Last seen:2020-11-05 14:44:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:Dsg0sf625UDUkmfPt5c/rMkluojVS2t4ol:Qg0w6tUfc/rUWg2t4ol
Threatray 979 similar samples on MalwareBazaar
TLSH 8215BFFA6246EA6BC40F043FF84B256193C9CF2D99F9904646C9B11D13BC6CE56AC4CB
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83270/
Detection(s):
Sanesecurity.Rogue.0hr.20201104-2004.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/521558
Signature
.NET source code contains potential unpacker
Binary contains a suspicious time stamp
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 309879 Sample: 90720.PDF.exe Startdate: 05/11/2020 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->57 59 Found malware configuration 2->59 61 Multi AV Scanner detection for dropped file 2->61 63 14 other signatures 2->63 7 90720.PDF.exe 6 2->7         started        11 NEWAPP.exe 5 2->11         started        14 NEWAPP.exe 4 2->14         started        process3 dnsIp4 43 C:\Users\user\AppData\...\sxvBukTqjnkqUw.exe, PE32 7->43 dropped 45 C:\Users\user\AppData\Local\Temp\tmp17E.tmp, XML 7->45 dropped 47 C:\Users\user\AppData\...\90720.PDF.exe.log, ASCII 7->47 dropped 73 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->73 75 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->75 77 Injects a PE file into a foreign processes 7->77 16 90720.PDF.exe 17 5 7->16         started        21 schtasks.exe 1 7->21         started        55 192.168.2.1 unknown unknown 11->55 79 Multi AV Scanner detection for dropped file 11->79 81 Machine Learning detection for dropped file 11->81 23 schtasks.exe 1 11->23         started        25 NEWAPP.exe 2 11->25         started        27 NEWAPP.exe 11->27         started        29 schtasks.exe 14->29         started        31 NEWAPP.exe 14->31         started        file5 signatures6 process7 dnsIp8 49 mail.ausvanlines.com.au 122.201.127.25, 49743, 587 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU Australia 16->49 51 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.153.147, 443, 49742 AMAZON-AESUS United States 16->51 53 2 other IPs or domains 16->53 39 C:\Users\user\AppData\Roaming\...39EWAPP.exe, PE32 16->39 dropped 41 C:\Users\user\...41EWAPP.exe:Zone.Identifier, ASCII 16->41 dropped 65 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->65 67 Tries to steal Mail credentials (via file access) 16->67 69 Tries to harvest and steal ftp login credentials 16->69 71 3 other signatures 16->71 33 conhost.exe 21->33         started        35 conhost.exe 23->35         started        37 conhost.exe 29->37         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e0f1a66466311d8610b4610fc7ce3c8ea4bb8b71528035cbe3ff2204c3dacd3/
Threat name:
ByteCode-MSIL.Trojan.AgentCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 03:24:23 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jyhruzsgmmi5qyiliyipy7hdzdvexofxcuuagxf6h7zcatb5vtjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b741b53e9abfd7d5147eff7fa963976a776e8bedb99d08ae6e7288525823a59
AgentTesla
74c4b80dac4f93d030f93df8f89b5c5321330a5b28243bd2020eb64f0b3bed62
AgentTesla
88801297a310f88fd29cf5b1e9066eee829a6bf43fe65108f4bc64932b1e845b
AgentTesla
ac0ca89c2e434d4128516896f5563003a1179583181d0d1fd06754f06ab4deed
AgentTesla
c58a7945058bbff6a2bf9aed5ba18ae7aa69cdd935fdafd6df4873680dc8a49b
AgentTesla
ca18e92f0eb610f92ce008b708acdca5969f308e319f5f128099514948dbd808
AgentTesla
cc2cc617d2d0f4b909be15f9720cdd9bdeade5fafe2b0c02eee852b15d33d366
AgentTesla
d98beb65dff0d8e1963f1cc7df755e273bbe45c8143b556bc9a84bcfd0cdea78
AgentTesla
ea6283f89a072a6fc910d5e1a023dd1b5b59b11b3dc18cf4773d7e03e68b21b1
AgentTesla
f6c28a76b12ddb94037c6cac0426ba87fb3201634731b901f66aecc15d5a98be
AgentTesla
+ 969 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201105-qjydrcshxa/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/d02bbff0-0a7c-45c7-b9b3-1bb2c1c76c3a/
SH256 hash:
dda707dea83724873893bd1e30e63dcbd4744adaa15562734c2da433e8025346
MD5 hash:
d9dbfcdccebb5f0d4c1dce16f0f449ac
SHA1 hash:
80e5797148ec2664b7bda8c2b5829f3566356fed
Link:
https://www.unpac.me/results/d02bbff0-0a7c-45c7-b9b3-1bb2c1c76c3a/
SH256 hash:
0d292db61f8a569779d5b5eeaabcebb699b09ace6a5e86e156828b02b80ad287
MD5 hash:
c2bad353ffb772c70ea69e350c61a4d2
SHA1 hash:
9eb4d530a1ac4c4a51efc0a64dcb6093a2f0105e
Link:
https://www.unpac.me/results/d02bbff0-0a7c-45c7-b9b3-1bb2c1c76c3a/
SH256 hash:
4e0f1a66466311d8610b4610fc7ce3c8ea4bb8b71528035cbe3ff2204c3dacd3
MD5 hash:
6c7ce45c08313b048b5749e1d0869b4f
SHA1 hash:
01ec13c0846a5c14af12f5d1bd4f036d788c7908
Link:
https://www.unpac.me/results/d02bbff0-0a7c-45c7-b9b3-1bb2c1c76c3a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 49ddcbb52b571b90c822d0d1f50b0d247585c5cbdb3f5120040fb55b83e8a659

AgentTesla

Executable exe 4e0f1a66466311d8610b4610fc7ce3c8ea4bb8b71528035cbe3ff2204c3dacd3

(this sample)

  
Dropped by
MD5 1ce22b72e877fa3ceb1cbf123470eddd
  
Dropped by
SHA256 49ddcbb52b571b90c822d0d1f50b0d247585c5cbdb3f5120040fb55b83e8a659
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/83270/

Comments