MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c
SHA3-384 hash: a41a914171c35593831c1a17da2e9914441c7dfaecda4aeee153f5c2333aa3a57d810f13a78a9ab2253d95b04507c2f2
SHA1 hash: 5828921401d69e1c9bf722a8be72336cb4ee8747
MD5 hash: 8c5abfbafa1f89f3b185991f8034e512
humanhash: lactose-autumn-double-idaho
File name:P09875794_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:977'920 bytes
First seen:2021-08-11 03:39:15 UTC
Last seen:2021-08-11 12:54:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:3YJSji6urlYEkG5p40JH1O3PSyQrG1iSaWpySbFh3XSjHnHE:3QHM/S5rYXpyS5h3ijE
Threatray 8'235 similar samples on MalwareBazaar
TLSH T143259CAE364072DFC877C972C9581C64EAA07877830BD247A05366ADEE5D49BCF241F2
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
P09875794_PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-08-11 03:40:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1a861c12-2261-4162-9eed-b723381b373e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/178071/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37380507.15543.17359.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4485979f-0d71-4297-93ab-c359f48f317a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/830579
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463010 Sample: P09875794_PDF.exe Startdate: 11/08/2021 Architecture: WINDOWS Score: 100 31 Found malware configuration 2->31 33 Antivirus detection for dropped file 2->33 35 Antivirus / Scanner detection for submitted sample 2->35 37 10 other signatures 2->37 7 P09875794_PDF.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\...\JKdWqoIIEsad.exe, PE32 7->19 dropped 21 C:\Users\...\JKdWqoIIEsad.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp2328.tmp, XML 7->23 dropped 25 C:\Users\user\...\P09875794_PDF.exe.log, ASCII 7->25 dropped 39 Detected unpacking (changes PE section rights) 7->39 41 Detected unpacking (overwrites its own PE header) 7->41 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->43 45 3 other signatures 7->45 11 P09875794_PDF.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 smtp.tanttec.com 11->27 29 us2.smtp.mailhostbox.com 208.91.199.223, 49732, 587 PUBLIC-DOMAIN-REGISTRYUS United States 11->29 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->47 49 Tries to steal Mail credentials (via file access) 11->49 51 Tries to harvest and steal ftp login credentials 11->51 53 Tries to harvest and steal browser information (history, passwords, etc) 11->53 17 conhost.exe 15->17         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 00:53:43 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrdkvhtnax57dg4elds643j7cd46wwuhjsmcsbysvj2fg433pkga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0542f550c85174e9246ada3140a9101d4c6349c1594364dba607e441dae6100b
AgentTesla
4f332e317c5116e7c9b64ea8084a39aa4fff859a056ce9463557bdb0093eab55
AgentTesla
88f94c1e8a555d84bf7ad2e0fe21d82d33f1976786267af93808cc050d039bd9
AgentTesla
a51bd84d3facb55aaa7d351f79a6383f50b362c48a7abf373675aedd13aa9770
AgentTesla
c9af30b2a800c774844eee76e019d10b72c4637adbccd34a6de3bcc8a4f32ba4
AgentTesla
cb8a7d1d9c86d996899769e9abac0b326053dae7f9d8fc226aabfa89f3f8d16e
AgentTesla
d23d794e3cf354c91c283e13eaeae77749e3265866758d999b99c06a98861a05
AgentTesla
da292ea9e3cda3911d3e6023e9ead0e663a14a1d089cabe7830d46f9c27caeaa
AgentTesla
e99bae3896aa527b7e77c3ecda493364d913cfa2ddf1ef0b1a072d9f4289764f
AgentTesla
f9989bce3ddcc0eb0f95bae744a31bd28e06b229f2757ad7fe7a92c8952ac78f
AgentTesla
+ 8'225 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210811-n4btyb29yx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ad2f0dddfe4f05ec9bb3ff3fbe64e5a12d28c6ae8db4849e1117bba16843d16d
MD5 hash:
792640af0271936d86f07afc86939bbd
SHA1 hash:
491ec41b6935bf6adfa49469b7f1d417444da3b6
Link:
https://www.unpac.me/results/c10e01d8-5b8b-4992-b109-9f973f39d49c/
SH256 hash:
ed0dd1e2260da7b03c8b80e0b45e8fef44be722c1e8c41e078c1a25ed0d18ecc
MD5 hash:
6057ce35bd926dd6d49dedfa9cc18372
SHA1 hash:
1f4e44e1740ffbd91129ac3a37d22845bc52c158
Link:
https://www.unpac.me/results/c10e01d8-5b8b-4992-b109-9f973f39d49c/
SH256 hash:
17962ca0f95358b5c1e6260448d3f1ec5de1c31d8d7965aa3e2abd9188d9762c
MD5 hash:
9d7dcf10f6020cb57f491493025db619
SHA1 hash:
1b02c93bedfa4282b27f4befbe2124884c5089ca
Link:
https://www.unpac.me/results/c10e01d8-5b8b-4992-b109-9f973f39d49c/
SH256 hash:
6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c
MD5 hash:
8c5abfbafa1f89f3b185991f8034e512
SHA1 hash:
5828921401d69e1c9bf722a8be72336cb4ee8747
Link:
https://www.unpac.me/results/c10e01d8-5b8b-4992-b109-9f973f39d49c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 6446aa9e6d05fbf19b8458e5ee6d3f10f9eb5a874c98290712aa7453737b7a8c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/178071/

Comments