MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562
SHA3-384 hash: a38e481c1daf7147b4d9e3a27eef857aa568d719b255134ba1026665440536dbebe3dc28ba70ddc7032d66c075d3ff44
SHA1 hash: 4a64591b1223f271a92a9c3844e6dbeaf88d328f
MD5 hash: 712b3ffc6b16afe212c27c9e709e768d
humanhash: papa-nineteen-speaker-lemon
File name:SHEDDDY.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:281'369 bytes
First seen:2021-03-04 07:18:38 UTC
Last seen:2021-03-04 09:09:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:l8LxBjoy2oyOAqwkvfyXDNE5E09BaJp7CulLLcSvW:09O+v6XJwbUJ9d+
Threatray 2'940 similar samples on MalwareBazaar
TLSH D054125ADAF0E87BD083DDB60E7ADA7FF6BBDB04855257478F700E7918806AA43C4142
Reporter cocaman
Tags:AgentTesla DHL exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SHEDDDY.EXE
Verdict:
Suspicious activity
Analysis date:
2021-03-04 07:23:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a08b989-1f44-4cad-8400-79a053f55e29

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122178/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/628194
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 07:19:11 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=of7lei5t4lwirsibgeotxmqd6lfmcbx2xerbnk3orgzvh27mcvra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
013066864283e4be87e7bd39b6e75ef40e98014377d520ffd213a8de2d59923f
AgentTesla
569d9358801eb518b152cb73009131508a3f14b136b0eb80025ccf438865a440
AgentTesla
5defd50046db301c82c85cc8306960982f576cbf5446f24062cc570dcf0becec
AgentTesla
62e4849bf2b02dd9508f6db60bc9f0d0e982ddfb607b9816e4a777c8cf5542ec
AgentTesla
69f4101e63fdfdec4a5b6fc4a778619a69f9511416dd90fe9df33502ff8d9d4f
AgentTesla
73884bc59571b3c7199849dcdfb8330b57435a822c320d1913eb990db842fbbf
AgentTesla
7579d907f11e31daadd189f27bb76ece470935be7d196e402030fae41615fca7
AgentTesla
7ad36d3f343d7d8357c9ca31d9ed0218c7913608b76e9cc6a98f4b1a7369fd55
AgentTesla
c40b3c5a2696e88864ddb4de1d3f1a9a93d50474908fb50aacda3a7b537b6b5e
AgentTesla
e41c50d817a963a03c07188bda3e42f164f1ce189f2875dc7f5125594d4ec159
AgentTesla
+ 2'930 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210304-ranwk4k1wj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
2f2746915ad56826a0130a51526b0afc7cf046956ca7dfa611a818f55b5ee2ad
MD5 hash:
d2da94adeb15df7fdb6d444faa4e20b8
SHA1 hash:
b83e6f9b666c7546a8043e516ec9280e5ceaba19
Link:
https://www.unpac.me/results/6c150103-55cb-42bb-9a3e-a0c2512e9e80/
SH256 hash:
b61a8883fc153a454e4a0b3d8a2a418b7db447dd46e00c772e02cd4d9c018390
MD5 hash:
c2971edf848216d9ff375fe68333e776
SHA1 hash:
247b2a0ea63ac1e890208cfe6cd18c036de068ca
Link:
https://www.unpac.me/results/6c150103-55cb-42bb-9a3e-a0c2512e9e80/
SH256 hash:
19d30e86ef584e18244cbe333616d1af729dbe5d67724369d7a621ee265b2640
MD5 hash:
fb9ac64969829a96c1b098c1033e470f
SHA1 hash:
5153d877b9bf05a7fbb5007250fc7bf910c3002c
Link:
https://www.unpac.me/results/6c150103-55cb-42bb-9a3e-a0c2512e9e80/
SH256 hash:
717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562
MD5 hash:
712b3ffc6b16afe212c27c9e709e768d
SHA1 hash:
4a64591b1223f271a92a9c3844e6dbeaf88d328f
Link:
https://www.unpac.me/results/6c150103-55cb-42bb-9a3e-a0c2512e9e80/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2

AgentTesla

Executable exe 717eb223b3e2ec88c901311d3bb203f2cac106fab92216ab6e89b353ebec1562

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 19afe353ceb17c7e1a38a40a09b53b097d5b8fb266e59c9d5c0ca08043489bd2
Cape
Cape
https://www.capesandbox.com/analysis/122178/

Comments