MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a
SHA3-384 hash: ffd86f96cadd58ee46b388b0d1ef4afac6d9d2e8dba2165d1ed8eaaefee395f4cfe413a18901c7f63c515d7d0568960a
SHA1 hash: 1af331f03cd3b72c47f114c0a9dd6bfced9fe604
MD5 hash: d83ce8c06464f808f0883cca9af6aa53
humanhash: oven-helium-gee-network
File name:d83ce8c06464f808f0883cca9af6aa53.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:512'000 bytes
First seen:2022-01-13 15:30:56 UTC
Last seen:2022-01-13 18:21:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:KGPKV8HACCNYvT7Ms+qxA4PMLtEUADKAhh:KG1AwT4s+ZeMLtzNW
Threatray 13'944 similar samples on MalwareBazaar
TLSH T170B401617AB9471FF9BB47B81D30D14087B2BC299851EB5C2CC171CD6AB67828B21F63
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d83ce8c06464f808f0883cca9af6aa53.exe
Verdict:
Malicious activity
Analysis date:
2022-01-13 17:54:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f8a581ee-6486-47d0-ac64-612cfbf9f7e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/219070/
Detection(s):
SecuriteInfo.com.Trojan.Siggen16.31828.23264.13957.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61e045c61883c5ba4ec8209a/reports/80538261-2657-4fa1-b07f-f437c9b54076/overview
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/92f54059-5cf5-4afb-a012-73dc9b4b434c
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/920230
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 552713 Sample: 2m8MSMXDrk.exe Startdate: 13/01/2022 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected AgentTesla 2->45 47 6 other signatures 2->47 6 2m8MSMXDrk.exe 3 2->6         started        10 xWBWc.exe 3 2->10         started        12 xWBWc.exe 2 2->12         started        process3 file4 25 C:\Users\user\AppData\...\2m8MSMXDrk.exe.log, ASCII 6->25 dropped 49 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->49 51 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->51 53 Injects a PE file into a foreign processes 6->53 14 2m8MSMXDrk.exe 2 9 6->14         started        19 2m8MSMXDrk.exe 6->19         started        55 Multi AV Scanner detection for dropped file 10->55 57 Machine Learning detection for dropped file 10->57 21 xWBWc.exe 2 10->21         started        23 xWBWc.exe 2 12->23         started        signatures5 process6 dnsIp7 31 us2.smtp.mailhostbox.com 208.91.199.223, 49814, 49815, 587 PUBLIC-DOMAIN-REGISTRYUS United States 14->31 27 C:\Users\user\AppData\Roaming\...\xWBWc.exe, PE32 14->27 dropped 29 C:\Users\user\...\xWBWc.exe:Zone.Identifier, ASCII 14->29 dropped 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->33 35 Tries to steal Mail credentials (via file / registry access) 14->35 37 Tries to harvest and steal ftp login credentials 14->37 39 2 other signatures 14->39 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-13 15:31:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mh4ixii6sklaayasc3uk2sgi7xget4zvjwjg5iavjbds6u6ndava._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
26ecc2fcee3b45b75f897db162661edf0175056b9d186b8bd0f2a0142b149211
AgentTesla
34edc761d3c1b959062dd653510f7b90c18742c39c5a4718090143a537d98c19
AgentTesla
3ccaa4f44b8c1a8132ce7184ea220ee8c1ff3ac16b53d2c69fb9a4776919afe0
AgentTesla
5bc2d62b2b117f3a496a1b5504fdece5024072e369b207b8b78d76b8afec10c4
AgentTesla
820c62207fb790251824280ec281caeb04dde02a3e0c895a9909f6e66c3fc2d4
AgentTesla
9a77338e958d0395f1906dec2d49b68b8418ec6a5b01b6f86704be52fe6f9a52
AgentTesla
ae945b72d3cf4d6c2caee7f56bd63396bc9dfae056b816fd974dca6b4d3b2ae4
AgentTesla
b88466caf387f61aefa6b1cb265f310ab73d3f2a855bed7bdc48c2f8b87c8cce
AgentTesla
cf774ec963cc1df8c5355621d4fe7195fd018b4826495d46b244be416b9bf167
AgentTesla
f95ebfd15f9b16c6c303ca343773c8c44b226c7343ac7aa4afac8045c6b1a5e1
AgentTesla
+ 13'934 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220113-sx4frabbd8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6d6255e43f8c15ac35d75832b1b8ac911010720326488ca424eee3e0566817c6
MD5 hash:
6fbeffefb041ca0248c2873f8f170127
SHA1 hash:
dc99780c9888bd4855c7fb8c75e95921ecd6a96a
Link:
https://www.unpac.me/results/154378aa-43d9-4777-8090-8401f13e2550/
SH256 hash:
a4c52e178f84a0624ecda1ef339a52433a55ea241e2dfc2cdc349d7cf4b14c3a
MD5 hash:
1805543b5c3997d423e2c56fc640136f
SHA1 hash:
b049b90e87d344d326aef6b36d5c2fb418a36d5f
Link:
https://www.unpac.me/results/154378aa-43d9-4777-8090-8401f13e2550/
SH256 hash:
c563f43cd0a4e36a445bc10e798e961aaebef2f8485ff3c87c298839b379d4d7
MD5 hash:
d489984d04f1f2b7d1df5cd62545e847
SHA1 hash:
5fc79635343077c2474360da13bf34e0b5e728a1
Link:
https://www.unpac.me/results/154378aa-43d9-4777-8090-8401f13e2550/
SH256 hash:
61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a
MD5 hash:
d83ce8c06464f808f0883cca9af6aa53
SHA1 hash:
1af331f03cd3b72c47f114c0a9dd6bfced9fe604
Link:
https://www.unpac.me/results/154378aa-43d9-4777-8090-8401f13e2550/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/61f88ba11e92/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 61f88ba11e929600601216e8ad48c8fdcc49f3354d926ea01548472f53cd182a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1962744/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/219070/

Comments