MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b
SHA3-384 hash: 7721313bc4bbda1d3b21fd3bbf614f3887a0728389472823901dd5dfb918425dc4c758e7db00d92597634fd606c39063
SHA1 hash: 7fde57655fbaa64cfa6b9630208be458375241c9
MD5 hash: fd1043b01a7770a0e49e5fab1170e8da
humanhash: apart-ceiling-louisiana-edward
File name:UPDATTED S O A -49565467GJ.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:793'088 bytes
First seen:2021-07-13 05:07:40 UTC
Last seen:2021-07-13 05:48:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:iHmxXYD4ibN9gYcxncp91baVOmjXJFKz2NENviFP1JkCsqiyk6B7zKK0g:bPiZqYUcz132ZGHiJfhiyP7V
Threatray 6'610 similar samples on MalwareBazaar
TLSH T102F4DF7A17CC4A27D7BE82B87A60F006F7A09C933B11CE0F56C771C51467A416AD2E6E
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
UPDATTED S O A -49565467GJ.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-13 05:09:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/582d2c41-5a1a-4c79-8f23-c539b2876110

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171225/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.26138.25444.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/49287bfd-6e1d-4334-be33-2987b7ce922d
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815272
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447683 Sample: UPDATTED S O A -49565467GJ.exe Startdate: 13/07/2021 Architecture: WINDOWS Score: 100 19 Found malware configuration 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected AgentTesla 2->23 25 6 other signatures 2->25 7 UPDATTED S O A -49565467GJ.exe 3 2->7         started        process3 file4 17 C:\...\UPDATTED S O A -49565467GJ.exe.log, ASCII 7->17 dropped 27 Writes to foreign memory regions 7->27 29 Allocates memory in foreign processes 7->29 31 Injects a PE file into a foreign processes 7->31 11 RegSvcs.exe 2 7->11         started        13 RegSvcs.exe 7->13         started        signatures5 process6 process7 15 dw20.exe 22 6 11->15         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 01:53:28 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=muyr4dk27sawmydotwytogyrhnrqzqk5jqunqmscopfkcvaoeenq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
22637e06185c1729dc491bf0d47763f8e549ae5a16223b04579240a0bbfa9f1f
AgentTesla
2954036992b7b420be7ab6d5318b44ab389a5d2ab6d60a24a3e02af504742aa0
AgentTesla
5dd92be22d005624d865ddf07402eb852426fc97baa52bbc58316690d41adb74
AgentTesla
80229ebcf769df182c0354a82f076cb2f093d95a2bde0af3d9ef740c1aa038a6
AgentTesla
81a5ce1c2439d2dca4eabecfc150f3fa1003f570913157a74cf1c5c1737f006d
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
92d4922b8c19be945de3640add234d12c124bed9faf7f5a0840b9571bec5abe9
AgentTesla
bda8b57cfb54635dddd83ed0fb37e2c37450494b1692c0a4e5985024c009e814
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
e2067df39b38f67a093c4f49577cd2273180b3069e120396fddb7ec5225e6fdb
AgentTesla
+ 6'600 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-t4zzjk13ba/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6b05c072e872ce14091e1d9aa75c5a833860fbca9d6c2d3202026870e9546e6c
MD5 hash:
32cd000793b72578c0607b8ba437743f
SHA1 hash:
e8add944f01649aba6393943fc2d0a4d2434b1e9
Link:
https://www.unpac.me/results/f2a466c7-4de3-4c14-a3c1-9f9c0af18fed/
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/f2a466c7-4de3-4c14-a3c1-9f9c0af18fed/
SH256 hash:
8bf3044a45b4921046749c65d4a465b3a9945e1c073d6786ccf31c56f5dcb3c3
MD5 hash:
ced39c7579ee12f6790c8495eeabe84f
SHA1 hash:
3477bcb93c0fdb9c40763dc85fd49bd2d7a53813
Link:
https://www.unpac.me/results/f2a466c7-4de3-4c14-a3c1-9f9c0af18fed/
SH256 hash:
65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b
MD5 hash:
fd1043b01a7770a0e49e5fab1170e8da
SHA1 hash:
7fde57655fbaa64cfa6b9630208be458375241c9
Link:
https://www.unpac.me/results/f2a466c7-4de3-4c14-a3c1-9f9c0af18fed/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5a740b22f20a87f666df1b40d9c0672caa1295681d79aec236f35c78444720c5

AgentTesla

Executable exe 65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 5a740b22f20a87f666df1b40d9c0672caa1295681d79aec236f35c78444720c5
Cape
Cape
https://www.capesandbox.com/analysis/171225/

Comments