MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84
SHA3-384 hash: 8895dd95c1ea8cd6b56264d3cfb0f25ab843956e6ee315986501bf6c1e7e0164b2c8e3d89546e02981df1b452e416557
SHA1 hash: ae068ca1a02edd4f2e50657a1f223e86f1bbe499
MD5 hash: 7c8ebff62083aaaa70e6ca8311776afa
humanhash: snake-ack-romeo-yellow
File name:Proforma Invoice No. 14214.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:948'224 bytes
First seen:2021-06-11 06:18:05 UTC
Last seen:2021-06-11 06:54:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:etYPbbR3qpPHzhM+2KObZUQW+v5JKAn77Oc9NGlqeEsXaYXZM4e/ZUdtb:eWjbo1HaMObeQHRJKjINUaCNeBUdt
Threatray 6'032 similar samples on MalwareBazaar
TLSH 1F1579F565E047C3D39EDDF187CAB3848B6F5AA231328211E44C22FC66DD28955CE68B
Reporter cocaman
Tags:AgentTesla exe INVOICE

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Proforma Invoice No. 14214.exe
Verdict:
No threats detected
Analysis date:
2021-06-11 06:29:58 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/ba85a9c6-9f17-4af4-a083-4784d5673771

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166012/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.31512.4929.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8950105e-42c5-497e-879b-3638d59176a1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800657
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Process Start Without DLL
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-11 01:37:04 UTC
File Type:
PE (.Net Exe)
Extracted files:
34
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=occa4xlwngiohdjklyqjcbwrt6yz5ha3o76c5mnyod3jrwq7dkca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09aee6abb9346613d79d14df006bde49924dfe308ca268e349ad134db2d0afa9
AgentTesla
0a27c51c891f44c26d8db8848822880a8209830faf2d8c00e8729151ae76be4f
AgentTesla
553f8d4b64f3f490db02424ac3613857f2fa288a63442a78414fa5393feaf2c7
AgentTesla
5def20f9a9f1c413c8bc154ba4a53d7d9a6cfedf4a8a84a342354dab99b12e3f
AgentTesla
60ea5d831209598cc0aebbd8d5f31f4bb43c29b054f565bbbcb5353b9c7ad06d
AgentTesla
7c5f8a44d779547d1fafecc0d0797d15e09779b2bef71aded94d47d3cd9fea74
AgentTesla
8512fc8573dfa04b285ab727c59db142972043d81866b485627bb5b15947af64
AgentTesla
b95c99701d429de9d8f52792d7a2b462ec6e342618a04ef419710b42e76293ff
AgentTesla
f86da0984972a912636cd654ce3650c36b600e2b69ed6276b5b898519bec6f48
AgentTesla
f97b20de4d8f123a11901c5dee2121c2c5b6f6d6baea3cb26404c53f5f681822
AgentTesla
+ 6'022 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210611-ycwkd4mtrs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
e987e066b6b1ca5c3698a367d405b671a7f33e388289cb6b191faf4796478596
MD5 hash:
8b3814abb5e9cd9fb5da34bc71a4afc2
SHA1 hash:
8005c030dd9d0c1f146d18c4597f0a0f55e16577
Link:
https://www.unpac.me/results/9419e23e-642d-4b4c-86f1-d7b7a792aa7e/
SH256 hash:
70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84
MD5 hash:
7c8ebff62083aaaa70e6ca8311776afa
SHA1 hash:
ae068ca1a02edd4f2e50657a1f223e86f1bbe499
Link:
https://www.unpac.me/results/9419e23e-642d-4b4c-86f1-d7b7a792aa7e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906

AgentTesla

Executable exe 70840e5d766990e38d2a5e209106d19fb19e9c1b77fc2eb1b870f698da1f1a84

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906
Cape
Cape
https://www.capesandbox.com/analysis/166012/

Comments