MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066
SHA3-384 hash: ea69bd20d9bc61ca7243225ec9ba2ee8881e3ad46985726c2c68702589578c71410caac62dd36fdbb782b7631c836e0d
SHA1 hash: f1491ccfddbe104abb09f963e6216d72605c5d8a
MD5 hash: 4b5f4d60b70efd2f25ac724a5096a4c6
humanhash: venus-mobile-king-uniform
File name:pleas.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:467'968 bytes
First seen:2021-09-14 04:24:10 UTC
Last seen:2021-10-04 11:39:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:I6FUHhVJyxzjD87cWf9/jaszMAeKrowGCpzk9qjyX:KBHyFn8v9b7KKGCpOqs
Threatray 9'796 similar samples on MalwareBazaar
TLSH T1ECA412AEB279BAEBE67D15F8C0F06EA8577090561091E7C21C8514DE09CEFDF09816CB
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
pleas.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-14 04:27:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c82128ad-8ae2-430a-bb87-7e082c159285

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187628/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61750929db358dd15ed91fcf/reports/01c88ce5-0d25-4cf3-9501-d01fb41755b8/overview
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/63bd49af-ccf3-4f6d-bae8-ede668445372
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850360
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 482787 Sample: pleas.exe Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 7 other signatures 2->55 6 pleas.exe 3 2->6         started        10 NXLun.exe 2 2->10         started        12 NXLun.exe 1 2->12         started        process3 file4 27 C:\Users\user\AppData\Local\...\pleas.exe.log, ASCII 6->27 dropped 57 Writes to foreign memory regions 6->57 59 Injects a PE file into a foreign processes 6->59 14 RegSvcs.exe 2 4 6->14         started        19 RegSvcs.exe 6->19         started        21 RegSvcs.exe 6->21         started        23 conhost.exe 10->23         started        25 conhost.exe 12->25         started        signatures5 process6 dnsIp7 33 upgcambodia.com 88.99.137.80, 49815, 587 HETZNER-ASDE Germany 14->33 35 mail.upgcambodia.com 14->35 29 C:\Users\user\AppData\Roaming\...29XLun.exe, PE32 14->29 dropped 31 C:\Windows\System32\drivers\etc\hosts, ASCII 14->31 dropped 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->37 39 Tries to steal Mail credentials (via file access) 14->39 41 Tries to harvest and steal ftp login credentials 14->41 47 3 other signatures 14->47 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->43 45 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 19->45 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-14 03:05:32 UTC
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jynh2k3zp2seukikxrijlxmpq6i74fairviziso2jpcjtix7cbta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
23e9628689de5cffc14abcc1d39a259f54bde8e50304af29d4e127359163e1c4
AgentTesla
2adae9b6592e71484038a7aff96306b4761fefe3f7bd7163e6bcba18c3427dd3
AgentTesla
4b55e32234637e16b302ccfb3b30c34cebce0022c958b6afe5214d8ae4a74be2
AgentTesla
7336a855a84f2f2d0f49c00a9ccdd993135369b15fa93fc429c31bdcdb002cf6
AgentTesla
78b89b05c3beb9d8275a36c785e9f629241c37768d3eca480ad18cd61cee01a3
AgentTesla
7e2f14e47ce41dff01f74023757a74a7352ff9ce7ee39d2f78b61ff2a5993897
AgentTesla
df730a5c1462ced883e78b64dbb7d34c7687b3e0b20914559a87a3719496818f
AgentTesla
eed29bcc7839a20dbdfb496d946de1f47404b693dff72cabfbd4d21f26d8ecd3
AgentTesla
f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff
AgentTesla
+ 9'786 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210914-e11blsegd4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ad4a7895d529d5164302bb88596964ab42ff125bf0f5544418c80b6d438cb587
MD5 hash:
43ababb6b0a02907aad43084f12b10d9
SHA1 hash:
b60ba705891d5a666d64300181b475a46714ffa8
Link:
https://www.unpac.me/results/facead05-2597-4b5e-a617-534bad1f7132/
SH256 hash:
78b0815965af0758f61087ce8675a585d2e676f795857d4c5b17de497b05058b
MD5 hash:
7722c902ffaa43094d0e018f9f2cc7b7
SHA1 hash:
660c767bed94648906228c036be69817e8d12af1
Link:
https://www.unpac.me/results/facead05-2597-4b5e-a617-534bad1f7132/
SH256 hash:
75b46b5b4564825e4cd06e04de90e137e38113fb878e55e6f6b3b2c93ca63925
MD5 hash:
537b08db973d6abecbb9fff14bf4d308
SHA1 hash:
408e865c542bb3e09fb6c99097cb325c3d7c4ceb
Link:
https://www.unpac.me/results/facead05-2597-4b5e-a617-534bad1f7132/
SH256 hash:
4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066
MD5 hash:
4b5f4d60b70efd2f25ac724a5096a4c6
SHA1 hash:
f1491ccfddbe104abb09f963e6216d72605c5d8a
Link:
https://www.unpac.me/results/facead05-2597-4b5e-a617-534bad1f7132/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4e1a7d2b797e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4e1a7d2b797ea44a290abc5095dd8f8791fe14088d519449da4bc499a2ff1066

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/187628/

Comments