MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1
SHA3-384 hash: b796fc40175f68c7ef4cee9deb611a88195d396e49447cad03d02d29c9782a4afd7b7fb42d39048b5779cc51e01c8b85
SHA1 hash: 33f950e298400ff3543388b044a35b7eae6ecd95
MD5 hash: a92d944fda1f617f62fa3e7b9b2a00ca
humanhash: sierra-foxtrot-eighteen-fanta
File name:DOCUMENTATION.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'400'832 bytes
First seen:2021-08-12 10:24:41 UTC
Last seen:2021-08-12 13:14:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:AjpKYGWKfFuBR5EGqiApZLGsaJaLhT2fXXvOO:aifFwYLL3GOhT2/
Threatray 8'339 similar samples on MalwareBazaar
TLSH T1A855C43C29BA2627D076D775CBE59827F4509CAF3161BD94A4CA73260372B5239C323E
dhash icon e4b8b878fcdcf9f0 (9 x Formbook, 5 x AgentTesla, 4 x Loki)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DOCUMENTATION.exe
Verdict:
Malicious activity
Analysis date:
2021-08-12 10:26:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a85f36a-8bdd-4f17-95bc-10a62662bc41

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178571/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.995-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7007ea7-32e4-4a82-b4c8-352a015977f1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/831642
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Allocates memory in foreign processes
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Process Start Without DLL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 464073 Sample: DOCUMENTATION.exe Startdate: 12/08/2021 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->31 33 Found malware configuration 2->33 35 Multi AV Scanner detection for dropped file 2->35 37 9 other signatures 2->37 7 DOCUMENTATION.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\...\kttPcYYKVO.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp3C9E.tmp, XML 7->23 dropped 25 C:\Users\user\...\DOCUMENTATION.exe.log, ASCII 7->25 dropped 39 Uses schtasks.exe or at.exe to add and modify task schedules 7->39 41 Writes to foreign memory regions 7->41 43 Allocates memory in foreign processes 7->43 45 Injects a PE file into a foreign processes 7->45 11 RegSvcs.exe 15 2 7->11         started        15 RegSvcs.exe 7->15         started        17 schtasks.exe 1 7->17         started        signatures5 process6 dnsIp7 27 us-east-1.route-1000.000webhost.awex.io 145.14.144.209, 21, 49730, 49731 AWEXUS Netherlands 11->27 29 files.000webhost.com 11->29 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->47 49 Tries to steal Mail credentials (via file access) 11->49 51 Tries to harvest and steal ftp login credentials 11->51 53 Tries to harvest and steal browser information (history, passwords, etc) 11->53 55 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->55 57 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->57 19 conhost.exe 17->19         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-12 04:38:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
27
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kylsrnzlz4m6nzcc3wvl7wbuzqc2pv3atytttkilohqjcp7qo7yq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
26eaa4455af41d380f557641e398485a404b5d73b2750f3bce3fa038eba96a7a
AgentTesla
349379e083c3e5aa94d3ef8564ee2b9bd9c678dcc0d215bd58a3f417372925ab
AgentTesla
72fcc6f870595e51729e155c8801c9fc48b429654198f842a423fbedd37349c0
AgentTesla
8d46b6ae4ba66360d4bc8be70090cba933a62d31bcabcdc40f86de26eda98160
AgentTesla
a69d7c4195cbe5ce32ac6b49ec6a95ec81a80849480cd261f9f613019dde351d
AgentTesla
a7b01fdf728630c86758c27cc4b945713802e67d67378cb82c73d8bb9a953d92
AgentTesla
a8cca0743895e1e92100e777ed334bd363ca2d2edfe734f7754df0e75d4d36c9
AgentTesla
cae74acee7ad600bbcebd34c778533f1bfe03d930adbf3c21ea56b1730c4f8ee
AgentTesla
d391b96f0df8e555d20e4a78af23d4535e234125ee2136b74496ed4ce22f9afb
AgentTesla
df2f7c58d54c8c6acc6c1dc4b23a423eeb00ce1817633275668c827069711e12
AgentTesla
+ 8'329 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210812-2d5gjermt2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
016f6dc101bd47fa66527b03847550917e89e40dc5ee29bbd35440468fa57714
MD5 hash:
47a4455fa34e5959aafe15e8001ce15c
SHA1 hash:
e9aa04d80f58a1a5e31c6d3b0c13c7793a162922
Link:
https://www.unpac.me/results/78129789-17b1-443b-8b85-ac0f826d5358/
SH256 hash:
33ac6b8012ce739e72022086b5d39b7fc030c20fa72988f76957685509d5c041
MD5 hash:
83f8ae95a7e6f016f6b00482588086e6
SHA1 hash:
70392939d6d60a913b51084ec1d98eaae8ca4868
Link:
https://www.unpac.me/results/78129789-17b1-443b-8b85-ac0f826d5358/
SH256 hash:
06100fadf6c1576e931299688f4212ea99fb8dc51c2259eda5d422c4987aa9de
MD5 hash:
9e8a33756653576c98b58a62c7488ccc
SHA1 hash:
10d6413e35679801cd4fc1fe9f541766cbfd9d5b
Link:
https://www.unpac.me/results/78129789-17b1-443b-8b85-ac0f826d5358/
SH256 hash:
561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1
MD5 hash:
a92d944fda1f617f62fa3e7b9b2a00ca
SHA1 hash:
33f950e298400ff3543388b044a35b7eae6ecd95
Link:
https://www.unpac.me/results/78129789-17b1-443b-8b85-ac0f826d5358/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/561728b72bcf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 561728b72bcf19e6e442ddaabfd834cc05a7d7609e2739a90b71e0913ff077f1

(this sample)

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/178571/

Comments