🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe
SHA3-384 hash: bcbf505779ea2ce87e743fa4a0d426a91b615ca61ac2c000fd605a257e4da4309d3b23abc346240cc496945696e93750
SHA1 hash: 703e55f988e5608eaaf0e5e3d68e86134c0ad023
MD5 hash: 6d06a8c0a9d0c0fb69187d7bdd4d4c03
humanhash: carbon-mississippi-tennis-wisconsin
File name:PURCHASE ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:855'552 bytes
First seen:2021-06-09 16:12:57 UTC
Last seen:2021-06-12 05:52:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'490 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 24576:Tt0cgUVYtXiZ5iO7h2tOVEQ+kIP46QHSzeEeWQcR2YHRZRI/FS:CUYtXiZ5f8tJrP463eEFk8Za9
Threatray 702 similar samples on MalwareBazaar
TLSH A105F1663668EA01C3AE1435C9DB402443F9EE4339B3DF657EC932CE1912B97ED01AD9
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
309
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165679/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37066304.3001.10841.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/799702
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 432098 Sample: PURCHASE ORDER.exe Startdate: 09/06/2021 Architecture: WINDOWS Score: 100 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 13 other signatures 2->41 7 PURCHASE ORDER.exe 7 2->7         started        process3 file4 27 C:\Users\user\AppData\Roaming\iAQuqHs.exe, PE32 7->27 dropped 29 C:\Users\user\...\iAQuqHs.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\Users\user\AppData\Local\...\tmp9502.tmp, XML 7->31 dropped 33 C:\Users\user\...\PURCHASE ORDER.exe.log, ASCII 7->33 dropped 43 Adds a directory exclusion to Windows Defender 7->43 45 Injects a PE file into a foreign processes 7->45 11 powershell.exe 22 7->11         started        13 powershell.exe 22 7->13         started        15 schtasks.exe 7->15         started        17 2 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 15:18:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
66
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=naxkoq6oxeqoul27vdfy5drqv2rkvkwm3egjz67lirvcejpaet7a._file
Verdict:
unknown
Similar samples:
01d28734442e0a373e558ce82a34dc36c73950e607fd3fd539e541c306e8c8f7
AgentTesla
1d617751cf801d9be1e0ea5a0afafbb6e1ad972fe02231c6b599a990f3d98c77
AgentTesla
3248fac227ec9ff6f7ec911825f76acaacb4fdf56e90ca17880c8e10d9e9f5f3
AgentTesla
6be099acb6f4355bfa2df1ec17c77ba9ad04630cf02ffc30aafa6ad7b29af2ef
AgentTesla
71259ef0e137c015e59e797eb4544c166e1ce9b007291357dcc5431b1dc0f680
AgentTesla
77c15c8e825d5c9818bbb2125926cac57fbbe8118599fcd9b3ecad868a3d851e
AgentTesla
845b22426e6b0d0632c1b69f07f27f93f332e0061198cb874d3a3d6fd8a5fd7e
AgentTesla
cd39caf7a8e34a6f771e0461e5ecb7ff3d74bed797ceba7bfb8ee391bcc5563a
AgentTesla
faca737d4aa23d55f6d5e25ce2b47f8f5060b8b62aa472073de85c50a21347d2
AgentTesla
fc4e2ba1dc3c25186846ec42f5ef46d77cb31dcbd8065445ae7a597323a0f0a7
AgentTesla
+ 692 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210609-wfd1gfvm9x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
34e69e90b7cb6121c3f93911f21dfb00491ea5d5bb79bfce4902d04f72c24184
MD5 hash:
b6b086a0ab13f3feb9ee8c846d230e5d
SHA1 hash:
dd8e1b816f3e7d9dcfa6eddc20a27fe0fbed478a
Link:
https://www.unpac.me/results/fb3de820-fe5a-4735-a148-ee18adbd1532/
SH256 hash:
682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe
MD5 hash:
6d06a8c0a9d0c0fb69187d7bdd4d4c03
SHA1 hash:
703e55f988e5608eaaf0e5e3d68e86134c0ad023
Link:
https://www.unpac.me/results/fb3de820-fe5a-4735-a148-ee18adbd1532/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c8d062b3595562cdcaf7cf2248be18b5361830347d9fe0f68eed823156101a7c

AgentTesla

Executable exe 682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c8d062b3595562cdcaf7cf2248be18b5361830347d9fe0f68eed823156101a7c
Cape
Cape
https://www.capesandbox.com/analysis/165679/

Comments