MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68442a9372810226cdbc091536d6b782ad6a503cf3a86f526f4f76c76866018d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68442a9372810226cdbc091536d6b782ad6a503cf3a86f526f4f76c76866018d
SHA3-384 hash: 36a6d95bdd514c62c19c0a8b3c02861cb0a730a9b58c8d37035734a08852075c09e0686d24737c512185a187efa3237b
SHA1 hash: 06da23ffe0b433ac70ceec4941cdd8b387d51a00
MD5 hash: 3dbcb098553adca73244c4ec06973fe8
humanhash: fanta-red-sodium-beer
File name:PO0038176 Mardexs.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:817'152 bytes
First seen:2021-05-12 09:11:14 UTC
Last seen:2021-05-12 10:02:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:edf0dzyDVykSQdmF+ETPKqMmjFeUpgtGA/HukbWOZq1MTBn/vpxYA7vWpEJ:Uf0WjdmF+/PingtGA/HuWWOo1MTBn/D
Threatray 4'860 similar samples on MalwareBazaar
TLSH EC05129C335476DEC853D8728E585DB4E620ACB2870F9A57FC13A28E9E4D4CBCB144A7
Reporter TeamDreier
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.24307.18960.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/779658
Signature
.NET source code contains very large array initializations
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/68442a9372810226cdbc091536d6b782ad6a503cf3a86f526f4f76c76866018d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-12 09:11:30 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbccve3sqebcntn4bektnvvxqkwwuub46oug6utpj53mo2dgaggq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1449ab878502264784833760558568c389ed7e39498b45048d6bf2e6611c50b3
AgentTesla
29af8f9271305888d917e56e139a3d9e8b4dfa0f5487f6604e9eba035e0d475b
AgentTesla
363de4e060c67ac8f0ecbc4b5bef9768a561e6c95dc26872a0c6258e9f3f71dc
AgentTesla
6d4d2a2d69e81b0f6b91a437aaf0869956306c347f0b2ed492168f95d6b24d93
AgentTesla
7d7924e92e2e23345b47169e428d4bc85cd5140e733e90512d28cef9e7d0c38a
AgentTesla
879fabd244225331efd47ce153381e8c2bcf02a9b81b430e346f6395ecc9c666
AgentTesla
c640be1855da7860bc3959d7d012b2d400af5c38e79d05a27639a867a37ac1f0
AgentTesla
c6b6c3ad94852d0fb8d6cf6d3aa2c4bfd14c627287317a72995a4c59a12d331e
AgentTesla
cbd84f6edacb90a5ce8c775df1407f377b95bf05653fc3ffa49e3c9f453eda39
AgentTesla
f555234fbdbb4926ef431de1dc159b005251c05ab1d5641fccd1fd7390af64c2
AgentTesla
+ 4'850 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210512-lcdqkh5qwj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1253930875:AAHtgtSce_nZyxAmWaCL8F3TRro9rp-ilvI/sendDocument
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/68442a9372810226cdbc091536d6b782ad6a503cf3a86f526f4f76c76866018d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments