MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4
SHA3-384 hash: 557c810d93bc3cdc1c9bc3e2b023d8efc267bbfeac28394386b05c1fdccb61cf2526076754051511cd8017afc1ae8b5c
SHA1 hash: 57d04194d7fc54f2a516723e59ce0d60a6114a2a
MD5 hash: f6b97ecae2a9494cdef040f6f58b9253
humanhash: earth-solar-seven-colorado
File name:HBL (36).exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:487'424 bytes
First seen:2021-11-30 04:23:23 UTC
Last seen:2021-11-30 05:37:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:EwgWwl2kQqvZRHOvGD5UjYNa4jrUBOvbAcMaBDqaiFCp4NB0CP2cT3NkB5v0rR/D:Ey0aBcEcPDq9Cps00FHsquLH
Threatray 13'099 similar samples on MalwareBazaar
TLSH T10CA4D09736A492F0E5391BB7BE93540E13726DF48D22C60C2B93F6CB2571B204E60A77
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HBL (36).exe
Verdict:
Malicious activity
Analysis date:
2021-11-30 04:24:38 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/adb2ed12-0dc8-4854-9ed3-5b1c21c3d432

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.ArtemisF6B97ECAE2A9.28473.17396.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61a5a764effcae2254f5222b/reports/8d50f07a-188c-4215-9c65-a4a893e07e2b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/18c9287d-c68f-4b38-a01e-59af5b9ebcb0
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/898397
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 530875 Sample: HBL (36).exe Startdate: 30/11/2021 Architecture: WINDOWS Score: 100 64 Found malware configuration 2->64 66 Multi AV Scanner detection for dropped file 2->66 68 Yara detected AgentTesla 2->68 70 10 other signatures 2->70 7 HBL (36).exe 7 2->7         started        11 NewApp.exe 5 2->11         started        13 NewApp.exe 2->13         started        process3 file4 48 C:\Users\user\AppData\...\hgkGEToVffYI.exe, PE32 7->48 dropped 50 C:\Users\user\AppData\Local\...\tmpCA9C.tmp, XML 7->50 dropped 72 Adds a directory exclusion to Windows Defender 7->72 74 Injects a PE file into a foreign processes 7->74 15 HBL (36).exe 2 5 7->15         started        20 powershell.exe 25 7->20         started        22 schtasks.exe 1 7->22         started        76 Multi AV Scanner detection for dropped file 11->76 78 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->78 80 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->80 24 schtasks.exe 11->24         started        26 NewApp.exe 11->26         started        28 NewApp.exe 11->28         started        30 schtasks.exe 13->30         started        32 NewApp.exe 13->32         started        signatures5 process6 dnsIp7 52 xelent.com.pk 95.217.199.12, 49781, 587 HETZNER-ASDE Germany 15->52 54 mail.xelent.com.pk 15->54 42 C:\Users\user\AppData\Roaming\...42ewApp.exe, PE32 15->42 dropped 44 C:\Windows\System32\drivers\etc\hosts, ASCII 15->44 dropped 46 C:\Users\user\...46ewApp.exe:Zone.Identifier, ASCII 15->46 dropped 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->56 58 Tries to steal Mail credentials (via file / registry access) 15->58 60 Tries to harvest and steal ftp login credentials 15->60 62 3 other signatures 15->62 34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 30->40         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-11-30 04:24:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oav2w5huxyh7mry5u5dwe2lgdgwzz33aqzof56czd5tylm63iksa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
371793ef15c6e1d0b0ab0edf326d4ab60ba5ce8cf26676fcc1ebd6329a23e914
AgentTesla
45c22ef191a04d054c8a9e4f873c8ccfe34527944da8c9f60dbb656c7a1dd30e
AgentTesla
5b27b810965060c9aa955425b2fdc1bfa682f8bdd56cf8fdfca2e614bea5d7a9
AgentTesla
63aa4b94125d5fd5621d354452e7f547b5937d099f3b92e1fc111f06136611fe
AgentTesla
6faef4e15fcae0545cbb7cdbb4200f4dcf7c18cdf12b072c65d779acef7d2092
AgentTesla
7c49ac4366eb07c5e5a146356908ba9e2e7e1bb2630422821f93530f0e2ec2ed
AgentTesla
e9910e5698751eadaa69204411cd4cfe896148b60e71687ab0bd741e790d0488
AgentTesla
f4bb5c1806e72df06936c0b9b1fefe3cfe5cf68604bdaa36ffbc61a2860aa6b9
AgentTesla
f87bef1ec7a4e68e8a9d2765a5fbfe2e0a66144a1efab71af82caad271654ee2
AgentTesla
+ 13'089 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211130-e1dgvaggb5/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
85fd1d8a6ecb7cf9bf6c65fcdefc6dc19c6f9e97e6d14e2814c658b7947dc90f
MD5 hash:
f3dbd24302cc843520183590ea016d84
SHA1 hash:
ef65ff6b63f378b35c564c0cbcdaf42e2b1b4033
Link:
https://www.unpac.me/results/64cd5d3c-a30f-4883-9192-bc485b6c386c/
SH256 hash:
9b25284ca175f1738bf83781a97a04c476b9874883b092a62e6d46343dbe90ef
MD5 hash:
bcbfdd243c545d295bdc8ee2200f7c9b
SHA1 hash:
db8314087fd33409bc409e3561e30a919c60b5d1
Link:
https://www.unpac.me/results/64cd5d3c-a30f-4883-9192-bc485b6c386c/
SH256 hash:
b19104b568ca3ddccc2a8d3d10ecddb1ea240171e798dc3a486292cfa14b6365
MD5 hash:
7b0900da932f4ed9630d65b04422736d
SHA1 hash:
6fa340436e3a8e73ae2b3e911f861483183c68ef
Link:
https://www.unpac.me/results/64cd5d3c-a30f-4883-9192-bc485b6c386c/
SH256 hash:
702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4
MD5 hash:
f6b97ecae2a9494cdef040f6f58b9253
SHA1 hash:
57d04194d7fc54f2a516723e59ce0d60a6114a2a
Link:
https://www.unpac.me/results/64cd5d3c-a30f-4883-9192-bc485b6c386c/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/702bab74f4be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 702bab74f4be0ff6471da74762696619ad9cef60865c5ef8591f6785b3db42a4

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment

Comments