MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7
SHA3-384 hash: 23beaf1feea600ce4d5e9718febab4e61523ce187a6cc505bdc3e5c9e79068793f154c0615bec90967525b1c746ef8e9
SHA1 hash: 839eee20a72b4d48b83366788af8bc6e9b9e8bcc
MD5 hash: 53001c5112da0cb57eec1b029ff01759
humanhash: cat-happy-crazy-maine
File name:53001c5112da0cb57eec1b029ff01759.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:397'312 bytes
First seen:2021-07-06 15:55:05 UTC
Last seen:2021-07-06 17:17:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'654 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:v57+zH1LRCvlivznmgRUgG4I8XrToTNDGPz12J1hfoYEECKWL1FzYafs5QWjlDEX:B7IrNP9o5CSoYEEC11FRWQWjlDE
Threatray 6'397 similar samples on MalwareBazaar
TLSH 9D84ADD8701034CFEC17E0B2AD5E9D6066583AAF831F82076113779D9E8F693DE27866
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
53001c5112da0cb57eec1b029ff01759.exe
Verdict:
Malicious activity
Analysis date:
2021-07-06 16:02:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/269f50e2-8988-49d8-bf3b-721f39c4889c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/170009/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.26302.901.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d855309f-8555-4c6b-b5e5-559ebb96c00f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/812482
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Process Start Without DLL
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 444891 Sample: VOdV58l7px.exe Startdate: 06/07/2021 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected AgentTesla 2->36 38 7 other signatures 2->38 7 VOdV58l7px.exe 5 2->7         started        11 0866.exe 3 2->11         started        13 0866.exe 2 2->13         started        process3 file4 28 C:\Users\user\AppData\Roaming\vlc\0866.exe, PE32 7->28 dropped 30 C:\Users\user\AppData\...\VOdV58l7px.exe.log, ASCII 7->30 dropped 40 Detected unpacking (changes PE section rights) 7->40 42 Writes to foreign memory regions 7->42 44 Injects a PE file into a foreign processes 7->44 15 RegAsm.exe 2 7->15         started        18 powershell.exe 1 16 7->18         started        46 Multi AV Scanner detection for dropped file 11->46 48 Machine Learning detection for dropped file 11->48 20 RegAsm.exe 2 11->20         started        22 RegAsm.exe 2 13->22         started        24 RegAsm.exe 13->24         started        signatures5 process6 signatures7 50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->50 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->52 26 conhost.exe 18->26         started        process8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-06 09:48:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojpeo3i5agkk2s2vv32wkooirdd34tkcethpeq4oyv2e4iyhep3q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
057829405c326876f0dfff1b3242e845a539fbe24fa5518dbee764adf7910fd8
AgentTesla
2d31d4b70c99a9be8ea02ebeedc419827e44569d3bd835bdfe29b46b89c99a1f
AgentTesla
3ee4e620dd7cb6d8a6f604e5653a4f5cbf1258032ffc7d13ae9a415c672a5713
AgentTesla
49f7415f7b85e989eed8d42e320c82ea6f69850650672ea6d7df65332a7e48c6
AgentTesla
704bd3f6c7d6671e896d71bc871f415cfc78209ae32cc518e95e39e7c06f83ad
AgentTesla
7c7323889466fa08d4a797ccdc8403e10953dae98d1f413bf39d82d7d9f89e5d
AgentTesla
8065f0a8fb9f149f281c0bb9988547651d0a6c9350352cfd4b2013c65be5ccd2
AgentTesla
9a44a213fb10bc7c0a49c89fd1274d80a4d90dbc328b38d7f1bd9db9c4b3dd4c
AgentTesla
e020e3dfac7560a591909a7f03724657e2037d1cb6cb9f6be27099e10951f5bf
AgentTesla
e484dd89ca41783addc420ae8b28e965997644a1bd7a9af1485dc239f21e2ac6
AgentTesla
+ 6'387 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210706-42d3vy4ln6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
9d77200aac104eac862d6291f0a138cb701056e062ed9a55989e89dc19d52d0b
MD5 hash:
93dc64f2fc0e879c057181fc2b40e6eb
SHA1 hash:
9aa2a7b9703bcbc8dd6fb2ad82ecf021289995d2
Link:
https://www.unpac.me/results/f495cabc-c61b-4108-a107-cc84f93929ae/
SH256 hash:
1846845b6fbbf29dcd28096aab20031b0ecad002c844651d2655529d26caf8a7
MD5 hash:
2e912f62320231f6bfc1255019b78814
SHA1 hash:
990965df5c553d233588d1f771ad73f09a0df3d5
Link:
https://www.unpac.me/results/f495cabc-c61b-4108-a107-cc84f93929ae/
SH256 hash:
5ab8a55fa88adbeaf3448f14b0b9b9720381b0646b178117c5be21f70843ae04
MD5 hash:
1839748f188de4a12ab57ba450a4413c
SHA1 hash:
218ddf363024c053f29152d792efaca1d684d708
Link:
https://www.unpac.me/results/f495cabc-c61b-4108-a107-cc84f93929ae/
SH256 hash:
725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7
MD5 hash:
53001c5112da0cb57eec1b029ff01759
SHA1 hash:
839eee20a72b4d48b83366788af8bc6e9b9e8bcc
Link:
https://www.unpac.me/results/f495cabc-c61b-4108-a107-cc84f93929ae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/170009/
  
URLhaus
https://urlhaus.abuse.ch/url/1430275/
  
Delivery method
Distributed via web download

Comments