MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69fc2a2b299dfe33b99ee74e6b67496bb157547cb33b15aa20a2bfeca68317e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69fc2a2b299dfe33b99ee74e6b67496bb157547cb33b15aa20a2bfeca68317e6
SHA3-384 hash: 7dac7bb54c5dc5edb6404758fa518b84f2cfde56f1b8d9cddcdbbfa0d6c00736b90b399afdcb32ac213e96e015cc0cb1
SHA1 hash: 7df57b385db73f8f7b564859e8d582fee78f1454
MD5 hash: fddefccbde348100d0af90a6c556e49b
humanhash: victor-nuts-wolfram-angel
File name:proforma invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:768'512 bytes
First seen:2022-02-10 17:08:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 12288:KVQMVjEUsCJfkKQVNfI+cX+tDNHM9tWf0LlaOIR7IM13MbxMiMWaU:opsCJwC+cXEZs9ta0LkOWVMbGiMW
TLSH T175F4232113FA9321D9FA4ABA6462B2011BBAF71B756BF30C459160F90D733E06A41F77
File icon (PE):PE icon
dhash icon f0c4b2d4f0a2ccf0 (25 x AgentTesla, 9 x Formbook, 6 x Loki)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/240691/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620546af54047500bb3bf98d/reports/8a84ca4c-182a-41ac-b74b-caa0f2b0f351/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/133a850b-5a81-4ab1-b963-d2dc1d3b5a2a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/937963
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/69fc2a2b299dfe33b99ee74e6b67496bb157547cb33b15aa20a2bfeca68317e6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-10 16:30:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
23 of 42 (54.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nh6cukzjtx7dhom645hgwz2jnoyvovd4wm5rlkrauk76zjudc7ta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220210-vn4q9saegl/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
f365b92b11041eed57b6f7534e83e04167fce1cfacc570e79335292f3c0ea8aa
MD5 hash:
9147a2ef317fe384182d1281e5af8110
SHA1 hash:
bbe360e6eca29a32e1f787e1416ddad4d35dcf1a
Link:
https://www.unpac.me/results/c3c6316d-5b42-48ff-8cfa-d049be18b100/
SH256 hash:
024990a63f1f0744724d5d8398a0aaf4c50ee1e9bc76fe81f7b139417c291856
MD5 hash:
de87ca6c2a5ea5d9b51bf8ea5c0e26ad
SHA1 hash:
a1b31db3cab12efc0930382fa521653439d3ad6e
Link:
https://www.unpac.me/results/c3c6316d-5b42-48ff-8cfa-d049be18b100/
SH256 hash:
9cdc53bcdbcb04ded7cbff525b6a6e9afa12ee16454655cc3b335ad5211f16bd
MD5 hash:
5d3baa9222fe2b0858e10ac7740fffc1
SHA1 hash:
8b0c4ecf92b00caed3675df6dfaa1899f79975cd
Link:
https://www.unpac.me/results/c3c6316d-5b42-48ff-8cfa-d049be18b100/
SH256 hash:
0e3042d777d3ee42b58aa9f3ebc62368230e88d09dc2eead6297f31d373e8017
MD5 hash:
79ef4888430891a016426394fe66a6b9
SHA1 hash:
7ef65c61ae65a443a159d5df780f5a5fafd4112c
Link:
https://www.unpac.me/results/c3c6316d-5b42-48ff-8cfa-d049be18b100/
SH256 hash:
69fc2a2b299dfe33b99ee74e6b67496bb157547cb33b15aa20a2bfeca68317e6
MD5 hash:
fddefccbde348100d0af90a6c556e49b
SHA1 hash:
7df57b385db73f8f7b564859e8d582fee78f1454
Link:
https://www.unpac.me/results/c3c6316d-5b42-48ff-8cfa-d049be18b100/
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/69fc2a2b299d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/240691/

Comments