MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 18

Intelligence 18 IOCs YARA 16 File information Comments

SHA256 hash:	70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47
SHA3-384 hash:	12b01a0813f779083a787786dfc6da3dfb5e02815bb69cb388fc4a71f0f9cbe166760a5c42652b2dfaaa1d1cd854150a
SHA1 hash:	84e7e9801debdf209aa64843e028ed6287d40ce2
MD5 hash:	299f8c6ca2b4f05721a1e7020c875b94
humanhash:	bacon-equal-football-grey
File name:	RFQ-4320018.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	893'952 bytes
First seen:	2024-03-12 06:55:37 UTC
Last seen:	2024-03-12 12:47:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'611 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:Sp/Sr+pAQ3inVFamzVO6HSn69uXD467R5ASI54eEOs9SgeRDMaDAl1:V+AQ32HrRxHS1D4674sOijeZ
Threatray	533 similar samples on MalwareBazaar
TLSH	T1BC1502516710CA9ED06A4B764813A6A59369CFA03F73CA1EF82F377ECB367C46E41121
TrID	71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	lowmal3
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

364

Origin country :

Vendor Threat Intelligence

Malware family:

agenttesla

ID:

File name:

70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47.exe

Verdict:

Malicious activity

Analysis date:

2024-03-12 07:02:07 UTC

Tags:

stealer agenttesla

Link:

https://app.any.run/tasks/1e2eb501-c06d-4bd3-8abd-2ebb1281ce49

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTesla

Link:

https://www.capesandbox.com/analysis/478703/

Detection(s):

SecuriteInfo.com.BackDoor.AgentTeslaNET.6.12793.5652.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Reading critical registry keys

Setting a keyboard event handler

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Adding an exclusion to Microsoft Defender

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65effc84fc3fe20efe65a796/reports/c20cca3f-9b73-4a5c-b30b-fe27b1a25718/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Agent Tesla

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bdf6070b-21b3-49c6-aff8-555801d3f0b5

Result

Threat name:

AgentTesla, PureLog Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1407232

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus detection for URL or domain

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Generic Downloader

Yara detected PureLog Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2024-03-12 00:59:37 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ob4j4p4e6wauslwegabr6q75hbmu33qzv2v6ur45ctr5gdxkjvdq._file

Verdict:

malicious

Label(s):

agenttesla_v4

agenttesla

AgentTesla

7b62fd54154e6ac5e545c1850a3a4c3a92b28f862e951c1bd36fc57ac5e89b3e

AgentTesla

91bc6a62a4edfbb4746bd801a6df29b49c3ec7b8c907f746f796ebe45a6c839e

AgentTesla

a05415162237c6bedaae4b41da31608b9e16c6f160a56c54425667c52593779e

AgentTesla

+ 523 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/240312-hqcz4sch86/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks computer location settings

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

06a1ae787e808d6287de314be8bec64ef2e0d3bc1bf2ea71ae268c7b8fb19e2d

MD5 hash:

91b39e533d48f5fa25ac604da90b3d8d

SHA1 hash:

f5dadf1e8fcbe64609e4cd78a27e2810f7a6e69e

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

SH256 hash:

c8c1020fe926cc1851b73c1915ad32e2fc393dccb402782aca8f4ea6379ba84d

MD5 hash:

ef7cf89d9ec52b18a8f5b6ee49820f46

SHA1 hash:

dcf9cb9bb3f72ca4b3cc0c00b27bd9ce10b554bb

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

SH256 hash:

c10c9b0882bac6f788f48b4dabe3291b14e639e650f2b9fcb0bc174ac92ae02b

MD5 hash:

7c7fb6daa78beb69128991ff893143ed

SHA1 hash:

c01bb99984b12b84129db80eae1d5d8341a358e2

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

SH256 hash:

4ad7f7faead2622899ef13cdc0a0d43fc8af2c6f3a0049b4517326802425b06a

MD5 hash:

df259eb6a1451890995484982a8bea61

SHA1 hash:

63bc375041ccc74842d23b3fe4e463e83d91e7d0

Detections:

AgentTesla

win_agent_tesla_g2

INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Agenttesla_type2

INDICATOR_SUSPICIOUS_Binary_References_Browsers

INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

INDICATOR_EXE_Packed_GEN01

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

Parent samples :

441cc4670d7c22a5b25f09d098e3d47022447e43f020b24f31e1d6ffc525a43f
1114073506daab881c22bce61bd90102035168e438f38e854f6ec4c06d6d32c7
1899cb937862bb84c5e4ab6a7211474a014cee50d4a05099a17ffb63ce8be0be
ccf1ae0cee4b76ff4f81cba060d3da0e91c79c40d25a837f778a2e70191abef1
86caff3276f512d98f8551121b2a9c0fa2a4c40291569af16fc08cc14ff3dae2
70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47
65425223dfa8ae8334cf347355822d3fe7589ccd6b35733db1e473a335c0e49e
35283152bb31940827ea64cdef4baf0f332f38b348d83dd3c34364b97f6d3d87
9dfd52d9008fad9915a2ce18b0f9e9a2dc6c513f7396d049a82faf97410950c1
4d907c3d7974732445e036c17d48ffa394628c26a25c5eac76eafd101d4299a3
0385e72feabb9b4207ae2266774849feb9d5179d036b4292e5ffed33c27a5f4a
7171159688e2f33a0545f09701d5d20ac73314cefc2cef8b62e8d4632fa650b3
29b22f8a33e8dd40cec2001bb1634769e1ab182fa93f4cfd90b13d8e3d955c28

SH256 hash:

99b9c1c5811e7499a8b4cb3a8b7bcc7d5072d976112254f8ce9afd7d26c71bf2

MD5 hash:

69020de4e73723a319d51d644267ba65

SHA1 hash:

4ddff60e3972d2d8086798a517dcb6c193515cda

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

SH256 hash:

70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47

MD5 hash:

299f8c6ca2b4f05721a1e7020c875b94

SHA1 hash:

84e7e9801debdf209aa64843e028ed6287d40ce2

Link:

https://www.unpac.me/results/793fff73-bb81-472d-802f-4e8c948f3045/

Malware family:

AgentTesla

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/70789e3f84f5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTeslaV3 Create hunting rule
Author:	ditekshen
Description:	AgentTeslaV3 infostealer payload

Rule name:	INDICATOR_EXE_Packed_GEN01 Create hunting rule
Author:	ditekSHen
Description:	Detect packed .NET executables. Mostly AgentTeslaV4.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many email and collaboration clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many file transfer clients. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing Windows vault credential objects. Observed in infostealers

Rule name:	malware_Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Windows_Generic_Threat_9f4a80b2 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_AgentTesla_ebf431a8 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

exe 70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/478703/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample