MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef
SHA3-384 hash: 23f7c8ebfc9a2b954d386ea40443d6e78c0f4992841e6c0969591a1ad3cd334ad72e12238ef9a6b851f4257480b58fba
SHA1 hash: bcdefb819d719b18af53f505974bad668b9064a6
MD5 hash: a910f802be30047b6f68c8bb43e684ad
humanhash: blue-rugby-cola-louisiana
File name:Amended Purchase Order 5180962.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:924'672 bytes
First seen:2023-03-06 10:24:10 UTC
Last seen:2023-03-06 10:28:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'814 x AgentTesla, 19'736 x Formbook, 12'282 x SnakeKeylogger)
ssdeep 24576:c1Qwe3cOQcsJvjtevELgV50pRib3MG0/o3A1IdK:cBycjtevqg7T3MRmL
Threatray 46 similar samples on MalwareBazaar
TLSH T1E215AF9132B194B3F5CB017964287ACC2C3C7153B6D4F24B6A777EC096019BBF6A8E52
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
206
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Amended Purchase Order 5180962.exe
Verdict:
Malicious activity
Analysis date:
2023-03-06 10:40:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11cd329a-6f6e-4926-9425-48c3b811c6e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/371904/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6405bf7fbfec0852a68fab7b/reports/3407bb47-0423-41c8-84f9-36000197d8b2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/781908c8-ad67-4683-aba3-fd63a030b660
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1187688
Signature
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 820564 Sample: Amended_Purchase_Order_5180... Startdate: 06/03/2023 Architecture: WINDOWS Score: 100 71 Multi AV Scanner detection for dropped file 2->71 73 Sigma detected: Scheduled temp file as task from temp location 2->73 75 Multi AV Scanner detection for submitted file 2->75 77 7 other signatures 2->77 7 Amended_Purchase_Order_5180962.exe 7 2->7         started        11 hweqdJGHxPN.exe 5 2->11         started        14 My App.exe 2->14         started        16 My App.exe 2->16         started        process3 dnsIp4 47 C:\Users\user\AppData\...\hweqdJGHxPN.exe, PE32 7->47 dropped 49 C:\Users\...\hweqdJGHxPN.exe:Zone.Identifier, ASCII 7->49 dropped 51 C:\Users\user\AppData\Local\...\tmp8C2B.tmp, XML 7->51 dropped 53 C:\...\Amended_Purchase_Order_5180962.exe.log, ASCII 7->53 dropped 87 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->87 89 May check the online IP address of the machine 7->89 91 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->91 99 2 other signatures 7->99 18 Amended_Purchase_Order_5180962.exe 17 5 7->18         started        23 powershell.exe 21 7->23         started        25 schtasks.exe 1 7->25         started        69 192.168.2.1 unknown unknown 11->69 93 Multi AV Scanner detection for dropped file 11->93 95 Machine Learning detection for dropped file 11->95 97 Injects a PE file into a foreign processes 11->97 27 hweqdJGHxPN.exe 11->27         started        29 schtasks.exe 11->29         started        31 My App.exe 14->31         started        33 schtasks.exe 14->33         started        file5 signatures6 process7 dnsIp8 55 api4.ipify.org 104.237.62.211, 443, 49716 WEBNXUS United States 18->55 57 flash-tours.gr 46.4.214.202, 49717, 49724, 49728 HETZNER-ASDE Germany 18->57 65 2 other IPs or domains 18->65 43 C:\Users\user\AppData\Roaming\...\My App.exe, PE32 18->43 dropped 45 C:\Users\user\...\My App.exe:Zone.Identifier, ASCII 18->45 dropped 79 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->79 81 Tries to steal Mail credentials (via file / registry access) 18->81 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->83 35 conhost.exe 23->35         started        37 conhost.exe 25->37         started        67 2 other IPs or domains 27->67 85 Tries to harvest and steal browser information (history, passwords, etc) 27->85 39 conhost.exe 29->39         started        59 64.185.227.155, 443, 49720, 49725 WEBNXUS United States 31->59 61 mail.flash-tours.gr 31->61 63 api.ipify.org 31->63 41 conhost.exe 33->41         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef/
Threat name:
ByteCode-MSIL.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2023-03-06 09:47:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
20 of 25 (80.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nfzdgfbxhmqqtzzcvuvptrvdmpbz2koftprnmnovve6zrl7kb3xq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c839aeb24cb1891e0e811643a0c1c59f4ed376c4160c7d40dcd20fd750dac0f
AgentTesla
12501d44e7fb05dbd0412c7f7983bb4f5bd7be9a6d8333a8fe42d1c219a04056
AgentTesla
5fdb6e2373c18ec9d19f822279bce3d0e84c731ae8c0410fdd613c59379e6ad9
AgentTesla
918057f4d236bf49e9efaceb3c4aaab580baf9960ac45d2fe8d97c5d98111f73
AgentTesla
a9f645191afe5a816749280ee777e840a940077ee62e30cfcf83063cab2741f3
AgentTesla
ae15c6da4acfc2083ef98cedf09140bdb66af29bc6c2bd7dc4061a887e6fb2e4
AgentTesla
e7534a0a853b8f9adac6cdf14f130c09c955b913726507f28a18c1e6700820aa
AgentTesla
efd5a5231f12bcaa48f701b82ff32314b313e5484fabe8596a7ce9283a08f71c
AgentTesla
f5f4515d071a9ef0fcaf8e3bb1d9f7f473f48082dfa5c25f63edb1be22e7a8ad
AgentTesla
f9b3b368ead42e40cc95eec1086d998fef8248e47985c15c45458c6415ffdca1
AgentTesla
+ 36 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/230306-mfy7tabb7s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
498c0460da26cfc2c4ec95b9b394bbd3db719ba08ccbd5964a533bc9006dcf8f
MD5 hash:
f4e7e91d4fdda2d3feb401b5b1d53abf
SHA1 hash:
cf9e76e6418850ac853bd9c6ce82a0be7920fc1d
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
SH256 hash:
4a64ac043750996f5943220f4e8680b12a464da03612cae7679d4dc61a4beb5c
MD5 hash:
77ea4b8e8bc031a8419aafdbad2a259a
SHA1 hash:
a09420964de28535e7ddfc084c75d3820b19ce14
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
SH256 hash:
d06df7395d561e198f9b7c5481567116ff2e4c2e84437c018d2a2c8ea6c4ca37
MD5 hash:
0fb6061f7d37424fb9e6d0e76b019c19
SHA1 hash:
98a64bf7b459f032d6ec5793003bf61b5ae1dd74
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
Parent samples :
495607b1aef01bf7dfb64b5cb16a8fc0f161c2923627d71c69de97328f8eca3f
2434aa78b46a3afc98fa6e888c3eb56278ba52b0ff800e7e875af9c2e7f9011a
SH256 hash:
5efbc5bc169425913064e053672ff074e6a0d1b7c0d6a51475350f4e82031f3a
MD5 hash:
f5a542bf346584eb57854300608f6a55
SHA1 hash:
6bc30aa08065c84c02dc5bb031f71f28f9f14fac
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
SH256 hash:
dfb204a8ff675d7b26e451aff2d43c1ad4ae080a0f52347bed708459aac1b309
MD5 hash:
9190e675002744070e2918cf463ffd40
SHA1 hash:
44aa72a2963ec3a5775d56450fae084d486f65fd
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
SH256 hash:
69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef
MD5 hash:
a910f802be30047b6f68c8bb43e684ad
SHA1 hash:
bcdefb819d719b18af53f505974bad668b9064a6
Link:
https://www.unpac.me/results/6e9ca049-bdbd-4aa7-b637-66aeb559bf1b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69723314373b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2ec421662543ccc943b335a4c9357556df5827a4bf980236e880b7ab939157ce

AgentTesla

Executable exe 69723314373b2109e722ad2af9c6a363c39d29c59be2d635d5a93d98afea0eef

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/371904/
  
Dropped by
SHA256 2ec421662543ccc943b335a4c9357556df5827a4bf980236e880b7ab939157ce
  
Dropped by
MD5 f613a99144225369d540e9b00618e19e

Comments