MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189
SHA3-384 hash: f71060cf3ec0d1996a2ad6bd888813387cc2ca1aad198018f83b0a7efcbb1a59fab85e7e23075937c8296b05cb93ef59
SHA1 hash: 5af6154a9d1b3dcf5a7bc32ae27a71270e61c56d
MD5 hash: 9712bab95cc28324a340f2dd2615565a
humanhash: shade-equal-grey-blue
File name:PO-2023831.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:899'072 bytes
First seen:2022-06-23 03:43:08 UTC
Last seen:2022-06-24 06:23:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:mANcgy1Y5dzcz02ndSXSnjLBlW13SMS3j8rKmaD/e0pAHbh9S1CKLCer3Ll/f+Fb:t+q5xK5ndSGH29cja
Threatray 17'547 similar samples on MalwareBazaar
TLSH T19215076B213CE0EEF86EEC749A140F54AA742C6A9236C107E12F3CD9D97F647DA150E1
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 31b09c969698b033 (55 x AgentTesla, 27 x AveMariaRAT, 15 x Formbook)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/282493/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Reading critical registry keys
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Changing the hosts file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed strictor
Link:
https://www.filescan.io/uploads/62b3e1591fcdba4e1a4bf623/reports/1c8c1688-3980-4c27-9277-c90c536f44b6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4fa6ebe-e7a1-40e6-8048-eeb42668fa83
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1018359
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-23 00:31:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
26
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kflqqwgggrbceol4a7g4unbfcqe5h5imojqciqtpugx64yr5igeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0d80a5d54c2d0a683b9d393c12f1df95de5904ba88aec7267a58ae112c985de4
AgentTesla
4b3b8f1f6ab69340cea4c78f21cb691e6efdb3ede2973a6315e947b281ea25c8
AgentTesla
4b3efdba2a0251d16190ac0faabe18091b391b70e55ac58d17f8ad2ac0baab68
AgentTesla
55a43bac7dbdab072611bc31cdb1ff9d2d1006508213dbe700f7d3422e8a542e
AgentTesla
683fcdb3fba783c37005aa82c2a83d694e21326d11c3c3ce2a4ee9815c23638b
AgentTesla
7ee83946ce5ddeb9a566c77ad6fead265689b8a6a0ae24bd616c080e8bf00995
AgentTesla
9d9cbc44c7dfafd9e5693f77c8847a4ac432153bff137abeef92f275d552c466
AgentTesla
fcf29b318efa13adacaeb61650a2e8f974d90670a61c46a3990a48592e95924d
AgentTesla
+ 17'537 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220623-eagrksecg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5167639867:AAFp5rpwhccJwSR0NNRceLhFKcs218dT21U/sendDocument
Unpacked files
SH256 hash:
b7fdc0bd384817f209ac8deff1a6d9687c4a624eca2b0eb396815929ee44c8a4
MD5 hash:
1479b4742c5cae37e27590955826f738
SHA1 hash:
80cfd76fa46fd8f19ec678af731d415bfe7a1d64
Link:
https://www.unpac.me/results/5030ed15-079f-472a-aa92-7de823249536/
SH256 hash:
a194a32bf7758a7c9f6831159c896fd8f97f566fb288744ef9a88e9f086730c9
MD5 hash:
469fe663deef644ef7aa2149620cc60b
SHA1 hash:
582d4d6d30eeaf48d1216a071d67908dc9afd90a
Link:
https://www.unpac.me/results/5030ed15-079f-472a-aa92-7de823249536/
SH256 hash:
79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696
MD5 hash:
39f524c1ab0eb76dfd79b2852e5e8c39
SHA1 hash:
428018e1701006744e34480b0029982a76d8a57d
Link:
https://www.unpac.me/results/5030ed15-079f-472a-aa92-7de823249536/
SH256 hash:
51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189
MD5 hash:
9712bab95cc28324a340f2dd2615565a
SHA1 hash:
5af6154a9d1b3dcf5a7bc32ae27a71270e61c56d
Link:
https://www.unpac.me/results/5030ed15-079f-472a-aa92-7de823249536/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/51570858c634/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e1ed2e3f33fc846bfa176440b2b845b3705469a1e0bea3e5e412401a3f1e82f2

AgentTesla

Executable exe 51570858c6344222397c07cdca34251409d3f50c726024426fa1afee623d4189

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/282493/
  
Dropped by
SHA256 e1ed2e3f33fc846bfa176440b2b845b3705469a1e0bea3e5e412401a3f1e82f2
  
Dropped by
MD5 7a74021404a0a06407db97813aafbf57
  
Dropped by
SHA256 6c0067eee0c245fb20054c12512eae13aa4f5e9a29a21dcf14b86a0fe64ea21c
  
Dropped by
MD5 96b6197cc42849cf3aec60750623c35d
  
Dropped by
SHA256 dfdd945227cd09c841306688092d14c38b9ff21e67099b77f9b6b1dc9168f1a7
  
Dropped by
MD5 a608c52ad073e93c7f1e96493d9703ef

Comments