MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61e6f5e7ac07ab1b9aa307b1f1feb3be8042a9440dfcdfdcfc6e710e3b0288d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	61e6f5e7ac07ab1b9aa307b1f1feb3be8042a9440dfcdfdcfc6e710e3b0288d6
SHA3-384 hash:	6cb92696d9d961e66488a736a86467ac756e1e76288fc3b45808f20d23daf4aa37aad5b6d810d82d77f06dc2997304cf
SHA1 hash:	9fe680fae77111fed15c897b9ca7bd5f3e39d0d4
MD5 hash:	230176dd9c90e941cb413b2c00446c3b
humanhash:	missouri-mississippi-texas-mike
File name:	230176dd9c90e941cb413b2c00446c3b.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	27'888 bytes
First seen:	2021-04-20 12:12:29 UTC
Last seen:	2021-04-20 13:01:47 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	384:ss1DTOPGJsLqQa9xlOYYFBoxD5IQNtTHaaNIUegLI5dd4WGaYb/98FAh:XDTOPCdYKOOtbV2U+j4WG9b/9Jh
Threatray	4'102 similar samples on MalwareBazaar
TLSH	62C25C94E2891D13C42D6D79B4F2390437729BE61E05E6AB6E4DC0D49E033CF8A6C6AD
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

QUOTE.doc

Verdict:

Malicious activity

Analysis date:

2021-04-20 12:10:03 UTC

Tags:

exploit CVE-2017-11882 trojan dtloader loader

Link:

https://app.any.run/tasks/ae862d10-226c-44b9-8a88-4ffbb5d83f9d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/139634/

Detection(s):

SecuriteInfo.com.Trojan.Siggen13.9900.10848.15898.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creating a file

Running batch commands

Creating a process with a hidden window

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process

Adding an access-denied ACE

Creating a window

Using the Windows Management Instrumentation requests

Sending an HTTP GET request to an infection source

Changing the hosts file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/689034

Signature

Found malware configuration

Hides threads from debuggers

Injects a PE file into a foreign processes

Modifies the hosts file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/61e6f5e7ac07ab1b9aa307b1f1feb3be8042a9440dfcdfdcfc6e710e3b0288d6/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mhtplz5ma6vrxgvda6y7d7vtx2aefkkebx6n7xh4nzyq4oycrdla._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

52898077d59e820a64decb2133661ee42a36259da3fb5e6bfbb6c6269fed7bf4

AgentTesla

532156143b3090b5036a00550bcd98e05d7805ccbbeb2170ae26888d626a64ac

AgentTesla

6906ef12bac9de7c7867bb067e2c7415680e07ffca9b9b3523cc2843e2174d7b

AgentTesla

7db8c02cc05e287e3d0219807e5e505b44f19180fa6401bc47107e92f36dd3ff

AgentTesla

962166f0ef5b1d6dd3e73c03575b5de20220feabe4f13a63d6441e66d1164563

AgentTesla

ae0e4f562ecbe6754699d92948d01d4080401d92bb2778e0d2f2ca7caf787cee

AgentTesla

b9f87900e53b232ee34c913e7b66cc0fa420dd3af54b12ff25fcbf1c64d0d934

AgentTesla

e4462cda605a876b2c8f72bcecbabd3e1abb00303a78047892ce463afef53127

AgentTesla

fda5edf4ca47ece8679d1e04e75d9af9f6ccf6510d56d2fe819f72ca09ec33d9

AgentTesla

+ 4'092 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210420-zlfmx8vygn/

Behaviour

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Drops file in Drivers directory

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/61e6f5e7ac07ab1b9aa307b1f1feb3be8042a9440dfcdfdcfc6e710e3b0288d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time