MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498
SHA3-384 hash: 949aabde6f2c4666e0199a316470dc346bea8d9fd006986781408141af41b98259d15b82a64df63a9b8e1a3fdd898981
SHA1 hash: 095525e37dd8c2711c6146549b414681fd34d443
MD5 hash: 3eff7ea8c109d0fb85e471405ac8a470
humanhash: lake-ceiling-kentucky-salami
File name:VSL’S CONTACT DETAILS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:918'528 bytes
First seen:2021-07-14 09:59:23 UTC
Last seen:2021-07-14 15:03:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Z3QUCG9ZHG0LzdfnUP1H1djMJUQdL0NWr8F2Aw2wNsU:Z3QUVmk1w1VdjxQ9APFGNh
Threatray 6'748 similar samples on MalwareBazaar
TLSH T184156C22A3C045DFCB7D42F87DB0B298FA585C7A66109E8B3FD23185617B62054BED1E
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
VSL’S CONTACT DETAILS.exe
Verdict:
Malicious activity
Analysis date:
2021-07-14 10:02:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/06e338c5-b34c-479c-810f-42e482cd074a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171620/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.5506.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/66415b79-29b2-41a5-b87c-de991d83e923
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816128
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498/
Threat name:
ByteCode-MSIL.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 06:28:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
32
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oc24jasv4tvk3p3myke5xsnsdrdkl7n7ruuzpyrs4glalffxisma._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
086678dd529edfefa648310df4fe02c88b97b3c3dfdca8b779511186b8ae543b
AgentTesla
321fc263ed3299c1e62a6184b309ad6f35ca50b322cc07f0ddcacfc1de35a60b
AgentTesla
578e555e4500342d23bc88795efd4cdf1146405a18827f9107a1120863b51de2
AgentTesla
5e6822d0bc5dc704978529cd98df1bf6bd86bb44240a6afc74e222b69260e29a
AgentTesla
81128282690c760fc04cb38f15ca0a5894f020a40d5fec7a85aca31de4c8745f
AgentTesla
8c25bbd2cf2a15f5e1aa7a5758e964c5910a3db33cbf0b7e4b05ce08c5d332a1
AgentTesla
8ca8da88cf80fd4385fa894d13e72c972ce9608bee0d013d9e3d1628df2b0b3b
AgentTesla
8f463e29a0ad7a756e1783e2aef3c46029dd74626a7c437772849ab921926b0c
AgentTesla
cbdd5947dfc9cc3dbe17166d0ceb0f2e91119ef9578e90b905b55d7a7dcd2f00
AgentTesla
f47f9d673a5a84c416306dcf513c59f56b686b4a17e1b12028c22672dc71fca9
AgentTesla
+ 6'738 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210714-j5ywzkfcns/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1765743101:AAFjAIqoiFu5pUMytacYpCrgIdiSe6mbRkM/sendDocument
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/194ce554-59ca-4b23-8aab-24cd873e23a6/
SH256 hash:
be72218a4684d27a24230978dd9279bb07b8a48a1af472aac11d51e39294e524
MD5 hash:
bd01a35cde0c08efefbfd317e7a8dce5
SHA1 hash:
7c2571f49982a747d9590e328d86f57c7abd99dc
Link:
https://www.unpac.me/results/194ce554-59ca-4b23-8aab-24cd873e23a6/
SH256 hash:
0b8119248b61fc7b8050b7f8d7fe19adfeb6a975224c8b5285a51a5321b83fc9
MD5 hash:
e9df23402f9e1714594cf7407e1d18d0
SHA1 hash:
3a8a9ad5de7a38c539bcfeede2f2b6e2ce066b2f
Link:
https://www.unpac.me/results/194ce554-59ca-4b23-8aab-24cd873e23a6/
SH256 hash:
70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498
MD5 hash:
3eff7ea8c109d0fb85e471405ac8a470
SHA1 hash:
095525e37dd8c2711c6146549b414681fd34d443
Link:
https://www.unpac.me/results/194ce554-59ca-4b23-8aab-24cd873e23a6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 88078fd25e03336ffce943a71bcb5b4bd9b4f754793c9a3b1b0f2de2c223b29c

AgentTesla

Executable exe 70b5c48255e4eaadbf6cc289dbc9b21c46a5fdbf8d2997e232e1960594b74498

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 88078fd25e03336ffce943a71bcb5b4bd9b4f754793c9a3b1b0f2de2c223b29c
Cape
Cape
https://www.capesandbox.com/analysis/171620/

Comments