MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906
SHA3-384 hash: 470a08e76f69c79e69714f99aaaee3af632d5aff1adce3df63a901605b510120193d394ecb5f1cac277ec4b04fbfaf37
SHA1 hash: ece08bc51d0f1a70fa7ef70feab4f86ba3aab3c2
MD5 hash: d8d6e959bf197ac2cf58849c96583d6b
humanhash: single-april-virginia-lemon
File name:soa.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'560'064 bytes
First seen:2021-06-19 14:19:28 UTC
Last seen:2021-06-19 14:34:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:3PZdBRGO3fCe94ghvDNgfU2SJmMMoDm1q:3vigdDysD
Threatray 5'963 similar samples on MalwareBazaar
TLSH B3751999724071DFC817C93289749C74E6217C7A871BD60BA0973AAEAE7D697CF100F2
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
soa.exe
Verdict:
Malicious activity
Analysis date:
2021-06-19 14:22:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a514fb0a-fbcf-4e7a-a987-26bdffdfdf3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167052/
Detection(s):
SecuriteInfo.com.Variant.Bulz.349164.22281.4911.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f02f028d-7175-4e7d-85c4-0632066bd8e1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804746
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 437157 Sample: soa.exe Startdate: 19/06/2021 Architecture: WINDOWS Score: 100 51 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->51 53 Found malware configuration 2->53 55 Multi AV Scanner detection for dropped file 2->55 57 6 other signatures 2->57 7 soa.exe 6 2->7         started        11 uwmDRDg.exe 5 2->11         started        13 uwmDRDg.exe 4 2->13         started        process3 file4 35 C:\Users\user\AppData\Roaming\UpRwqeC.exe, PE32 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmpA509.tmp, XML 7->37 dropped 39 C:\Users\user\AppData\Local\...\soa.exe.log, ASCII 7->39 dropped 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->59 61 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->61 63 Uses schtasks.exe or at.exe to add and modify task schedules 7->63 15 soa.exe 2 5 7->15         started        19 schtasks.exe 1 7->19         started        65 Multi AV Scanner detection for dropped file 11->65 21 schtasks.exe 1 11->21         started        23 uwmDRDg.exe 2 11->23         started        25 schtasks.exe 1 13->25         started        27 uwmDRDg.exe 13->27         started        signatures5 process6 file7 41 C:\Users\user\AppData\Roaming\...\uwmDRDg.exe, PE32 15->41 dropped 43 C:\Windows\System32\drivers\etc\hosts, ASCII 15->43 dropped 45 C:\Users\user\...\uwmDRDg.exe:Zone.Identifier, ASCII 15->45 dropped 47 Modifies the hosts file 15->47 49 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->49 29 conhost.exe 19->29         started        31 conhost.exe 21->31         started        33 conhost.exe 25->33         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 14:43:14 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kabgwutysa2xaaa5c3aj3gszsjmjonr4wj3kkvhtjx3ffhy55eda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3aaa20c0b1ee7289fefdc94cb16c27a077ae3519a3d766e2431fa01719bdfcdc
AgentTesla
3f2cba483eead01ce5217afd98d8308007cf4b4b5e81bd658d27b9f31abc4b77
AgentTesla
3fd2c91007c4b1429d70710853232018e8da2528d375af5d64b79901254e52f0
AgentTesla
4fddab664cacd0052224d92debf4fb6e098794e8654cf5eed67c917f6416c909
AgentTesla
5a2ce470fbe1babd44df83899f5909e3dcd031bc95de5a748f473f288084de7a
AgentTesla
7beacc03c7e9d87b052a52f5b7dd889b581eae833a3d2bfb6cb29a2c68944727
AgentTesla
a792c75171ffe33735115662b89bb58635c750e2405cb30556faf96e26769c8d
AgentTesla
e302f84b5e07423e7ed616296ee78b39ed487f43360491dc68907a3b6f0760d4
AgentTesla
eb12f5ac4c8669a097af19e970c05103b43e542a4ad162401c68acef25ff8b5c
AgentTesla
eef7a356ee8fe700db6449e4355c3f79dcb744d176fb3556bcd004be30d9d43b
AgentTesla
+ 5'953 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210619-gz7amw7et2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6b65a0b9fd2c603c098361c3f8d15138d536cdc745e2f5df66735d94937d2d8f
MD5 hash:
15515476b2bc36c784cc54e9a4802763
SHA1 hash:
f1a36f5445468739d64a110c30da9423753022ff
Link:
https://www.unpac.me/results/0a4f5add-6d5b-4b02-ac14-fefe0278ea57/
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/0a4f5add-6d5b-4b02-ac14-fefe0278ea57/
SH256 hash:
18f048fe4d43531f47a10da77988d1208d216d87a753a38ac2502854243d7f57
MD5 hash:
c6d7f52162008e8fd8ac99f0e053cfc0
SHA1 hash:
63504dcee4db51cb1b1a18055ff018e4b0c4dc7a
Link:
https://www.unpac.me/results/0a4f5add-6d5b-4b02-ac14-fefe0278ea57/
SH256 hash:
50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906
MD5 hash:
d8d6e959bf197ac2cf58849c96583d6b
SHA1 hash:
ece08bc51d0f1a70fa7ef70feab4f86ba3aab3c2
Link:
https://www.unpac.me/results/0a4f5add-6d5b-4b02-ac14-fefe0278ea57/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:dridex_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 50026b5278903570001d16c09d9a59925897363cb276a554f34df6529f1de906

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/167052/

Comments