MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61bbef9231fc7e207a317b3122ed87103d7c71f02923fc551e7a04bc84e8c350. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments 1

SHA256 hash:	61bbef9231fc7e207a317b3122ed87103d7c71f02923fc551e7a04bc84e8c350
SHA3-384 hash:	36b201c2d5e2da4041ddbec18869bc328f86b635d299bea78b8eba0614c67680d4d368a6e039284748d1b6e1d8b7492d
SHA1 hash:	b5f30d18846d350042af01753a538142413b993d
MD5 hash:	0e6b2b68110c10ec992ae04dfb70d628
humanhash:	don-happy-india-cat
File name:	0e6b2b68110c10ec992ae04dfb70d628
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	63'928 bytes
First seen:	2021-11-16 14:46:38 UTC
Last seen:	2021-11-16 18:03:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	1536:WMi4PVKkqWoC7S22iiD5eWSQOLluDrMQ8pSHDHV:yWv7Bi9eWSQOqMMHx
TLSH	T1D8537C01352C656BDAADCBBA01528540333CA657E61ED70E7EA7A0CDE9D33434B50BAF
Reporter	zbetcheckin
Tags:	32 AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

104

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/206507/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1053.1884.15577.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Connection attempt

Sending a custom TCP request

Creating a window

Sending a UDP request

Using the Windows Management Instrumentation requests

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Moving of the original file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

overlay packed packed

Link:

https://www.filescan.io/uploads/6193c46c43e8f62b669574b5/reports/bc1a41b4-fb69-45d7-a420-0112c708cb13/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/813d0c77-a46f-4ef7-af42-865c3ef6a7cf

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/890466

Signature

Found malware configuration

Moves itself to temp directory

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61bbef9231fc7e207a317b3122ed87103d7c71f02923fc551e7a04bc84e8c350/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-11-16 14:25:39 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Verdict:

unknown

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla collection keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/211116-r5vyxabccq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Accesses Microsoft Outlook profiles

Adds Run key to start application

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

61bbef9231fc7e207a317b3122ed87103d7c71f02923fc551e7a04bc84e8c350

MD5 hash:

0e6b2b68110c10ec992ae04dfb70d628

SHA1 hash:

b5f30d18846d350042af01753a538142413b993d

Link:

https://www.unpac.me/results/dae7341f-f935-4294-9bac-42f0ae3d8300/

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/61bbef9231fc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/61bbef9231fc7e207a317b3122ed87103d7c71f02923fc551e7a04bc84e8c350

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research