MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9
SHA3-384 hash: 0c652e32b25e7f2524df3eae2df4fda6eee6ef9ea25c5c1a411aed3dd52e21ddec9d0a059f3f83450cacffa1757350e6
SHA1 hash: d2e85dafffd899ef856527828b954a972ff93242
MD5 hash: b030dc082c9cc8856015d9275cd878e9
humanhash: berlin-video-hotel-india
File name:PORCHASE.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:545'280 bytes
First seen:2020-09-24 18:22:14 UTC
Last seen:2020-09-25 05:21:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:8w6S2j8oB7ZOFANWfPs7Wmt5uaBMvl+D3IWTshF0po7:8wmh7Zsd1mtAaBMNh9hF0p0
Threatray 268 similar samples on MalwareBazaar
TLSH E4C41927A1074421C81853BA0D6BEFF461929FF71A63EB5B13E17E6BFE71C9B2615008
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.21336.2864.2252.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/474502
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289698 Sample: PORCHASE.EXE Startdate: 24/09/2020 Architecture: WINDOWS Score: 96 53 Found malware configuration 2->53 55 Antivirus detection for dropped file 2->55 57 Antivirus / Scanner detection for submitted sample 2->57 59 7 other signatures 2->59 8 PORCHASE.EXE 2 2->8         started        12 po345.exe 2->12         started        14 po345.exe 2->14         started        16 2 other processes 2->16 process3 file4 49 C:\Users\user\AppData\...\PORCHASE.EXE.log, ASCII 8->49 dropped 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->71 18 cmd.exe 1 8->18         started        20 cmd.exe 2 8->20         started        24 InstallUtil.exe 12->24         started        26 InstallUtil.exe 14->26         started        28 conhost.exe 16->28         started        30 conhost.exe 16->30         started        signatures5 process6 file7 32 po345.exe 3 18->32         started        35 conhost.exe 18->35         started        43 C:\Users\user\AppData\Roaming\...\po345.exe, PE32 20->43 dropped 61 Drops PE files to the startup folder 20->61 37 conhost.exe 20->37         started        signatures8 process9 signatures10 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->51 39 InstallUtil.exe 17 4 32->39         started        process11 file12 45 C:\Users\user\AppData\Roaming\...\WPKvJYN.exe, PE32 39->45 dropped 47 C:\Windows\System32\drivers\etc\hosts, ASCII 39->47 dropped 63 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 39->63 65 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 39->65 67 Modifies the hosts file 39->67 69 2 other signatures 39->69 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 02:15:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=naaubuyvjjdpoahi352ksjz2de5pzzx6pionkmthfmmeesu3bwuq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19b7ae6956a38825ac143952843f6e046c642a9dc635e18d4f84dcff4568c142
AgentTesla
292593bea6386f07e2349a1df9d7eb04ab845d51368605b0c63825e6fffbb120
AgentTesla
2f3474e57e4d3df1cedeef87e3716fa9143a63cf7ffdd9273273f41c8a8bc223
AgentTesla
3c359f5677b780cc968723ceca8310ed20ae4bf691bd9900c7d334303b101776
AgentTesla
8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9
AgentTesla
c9692914eb11d2c1cfb26bae5877943c1769994f857f0aa85b8c8f5064a2f042
AgentTesla
cf22a4ba35e94ec83bdf1aec7b4422009aa33f7c6a2c707513d7b1a9eafb368c
AgentTesla
d98f8380522e71c61b91d1fbdf98c0528fc20388a85695529824754f00a183a1
AgentTesla
dc4eaa151b01375e0ba2392396b60e6abebab99e5590c93ab23ee3063aba5eb5
AgentTesla
e03c4f9c8ae0b28a7538315c3af97428339911bd6118371c0459adfd14abca44
AgentTesla
+ 258 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200924-s3tmq8ahtn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Drops startup file
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc

AgentTesla

Executable exe 680140d3154a46f700e8df74a9273a193afce6fe7a1cd532672b18424a9b0da9

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c3456f02a4372b8b702cf8661d009098a9e493211e59e9489d215d734146c7cc
Cape
Cape
https://www.capesandbox.com/analysis/65534/

Comments