MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241
SHA3-384 hash:	686af97c29dec779687f42363d8f077059a2fa3f57dfb7a959c86975a87fc3980f118b37fe203f0bf6f08af828425d87
SHA1 hash:	3106b077986c969dc66c184e9f6dd9b40521fce0
MD5 hash:	0382a0d9fbdced0d386023c24c35246a
humanhash:	autumn-hawaii-cola-neptune
File name:	Proforma invoice.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	609'792 bytes
First seen:	2020-10-22 04:33:51 UTC
Last seen:	2020-10-22 06:00:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:xN0SAk4dT7a+ztAZBBbFbwrApSeVNkAR2JrurLiIs9A1GKZHNYPzod:30YiT7aCmnBFbwrA/HkO2wniI0A1GUKo
Threatray	707 similar samples on MalwareBazaar
TLSH	78D4126151ADAB32E3BD8BF6304C142A83B1148E57B2E7685DF377EA7960B058BD0D13
Reporter	GovCERT_CH
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/74409/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.hc.9567.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/506563

Signature

.NET source code contains potential unpacker

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241/

Threat name:

ByteCode-MSIL.Spyware.Noon

Status:

Malicious

First seen:

2020-10-22 03:52:55 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nz5foqofzm5tstx657k4vqohdubd35z6jqm2ak454zhkdinoijaq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5017799e48545886ac896d038e3e9706fa65fb8a8644be0879279fe608dbdf66

AgentTesla

72abc3324eb1018186ae67c74ff5a7f319360a80a2f0887cb75e6dbd86a2ebcc

AgentTesla

757d376a5edc5d260ab3fb209797dbbdf3ce43f6331432174b1398f14e723e20

AgentTesla

8348c6c60034429d7bca499c5cfb52d04f0705cda36665cbff5db267958811ef

AgentTesla

b3b1f3479b7d0033e21ef89ccea063a0281604d4472252cf590ec99be5aa2eb4

AgentTesla

bd5f6e5567639e5e1c4619a02ff2db2eb3242cd6e25e50f7b7559202fc7f061c

AgentTesla

cc6c48150c475d3312f01a96a5301e2263cc4c821e2d6a48b4bb2bdb07edb968

AgentTesla

e6793974644f3523b0e79add22e915ae65bcda618b397dd42a6877d2b3e9e2c0

AgentTesla

ffbc4a39ad58fc82025ec9dd1abcba049dc7c66a1ccb8b71fe2171e65f41b526

AgentTesla

+ 697 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger trojan stealer spyware family:agenttesla

Link:

https://tria.ge/reports/201022-59shwwhf9j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241

MD5 hash:

0382a0d9fbdced0d386023c24c35246a

SHA1 hash:

3106b077986c969dc66c184e9f6dd9b40521fce0

Link:

https://www.unpac.me/results/88e6e239-7fa0-495b-ab37-07d53090e247/

SH256 hash:

785c40ecec54091e7955136a40683a65dc725abac655ca1a3b36f6a6f9540b25

MD5 hash:

88c7105f5993ef61d373ffe04afddc68

SHA1 hash:

208e4f6f58aa9e8019013f32f7453671de895a89

Link:

https://www.unpac.me/results/88e6e239-7fa0-495b-ab37-07d53090e247/

SH256 hash:

31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b

MD5 hash:

0aebe46040ceb011e78506d4985fe3de

SHA1 hash:

218ac1e7b14a66c604ec3042f8486bed9cd4c2c1

Link:

https://www.unpac.me/results/88e6e239-7fa0-495b-ab37-07d53090e247/

SH256 hash:

096a2c569cd4711ff9e66992768b2f6f255897551821ba2366976d0a794fde3a

MD5 hash:

819cc5b74836413eee32c02680d3ad6c

SHA1 hash:

c1b93185aec9fdcf68d3bbd6cb26da753a1e3dd1

Link:

https://www.unpac.me/results/88e6e239-7fa0-495b-ab37-07d53090e247/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.