MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c
SHA3-384 hash: 6e9ea456efe54c0815b0ed185c64f49d3c811eeeb7919be6217b8b477ef32c6589cb933149a8da892599cffae4322475
SHA1 hash: 462fbadc94dd49cd20b6b58c34dffaa3d13d49c4
MD5 hash: 06de5d7a4d6459a95b3027489fb6c169
humanhash: uncle-low-moon-friend
File name:06de5d7a4d6459a95b3027489fb6c169
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'064 bytes
First seen:2021-10-30 08:19:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:IoUKKKEJEePudkcC/OGPQ7f1INHRQEQna:TJKnJxPuqT/GIRFQn
Threatray 12'462 similar samples on MalwareBazaar
TLSH T11694120027B84B0EE5BD67F60E7B2A049F32F62B6563E75D6DC141C90976B018D92E3B
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
06de5d7a4d6459a95b3027489fb6c169
Verdict:
Malicious activity
Analysis date:
2021-10-30 08:25:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7778a701-7e1d-4bb6-9bcf-7610c6f4cb39

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Inject4.17696.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/62af05b3-b899-44df-9e2f-208b9cb7de38
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879758
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 512192 Sample: dhDTNsKFOg Startdate: 30/10/2021 Architecture: WINDOWS Score: 100 32 us2.smtp.mailhostbox.com 2->32 36 Found malware configuration 2->36 38 Antivirus detection for dropped file 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 7 other signatures 2->42 8 dhDTNsKFOg.exe 7 2->8         started        signatures3 process4 file5 24 C:\Users\user\AppData\...\wkrYXmSmSPPhL.exe, PE32 8->24 dropped 26 C:\...\wkrYXmSmSPPhL.exe:Zone.Identifier, ASCII 8->26 dropped 28 C:\Users\user\AppData\Local\...\tmp28F3.tmp, XML 8->28 dropped 30 C:\Users\user\AppData\...\dhDTNsKFOg.exe.log, ASCII 8->30 dropped 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->46 48 Uses schtasks.exe or at.exe to add and modify task schedules 8->48 50 2 other signatures 8->50 12 dhDTNsKFOg.exe 2 8->12         started        16 BackgroundTransferHost.exe 13 8->16         started        18 schtasks.exe 1 8->18         started        20 dhDTNsKFOg.exe 8->20         started        signatures6 process7 dnsIp8 34 us2.smtp.mailhostbox.com 208.91.198.143, 49792, 587 PUBLIC-DOMAIN-REGISTRYUS United States 12->34 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->52 54 Tries to steal Mail credentials (via file access) 12->54 56 Tries to harvest and steal ftp login credentials 12->56 62 2 other signatures 12->62 58 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->58 60 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 16->60 22 conhost.exe 18->22         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-20 01:49:49 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ojxp2ebthxi4xvggl2kbel46axr5tthq74ok5wg5wqq7g5ujfa6a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1a4303aab126cc29cb12fbce8ae802898733bf4b08d531a3ae09994b22f5540d
AgentTesla
243f776b0d785b22e96738058e3cdfa0896c41948f80b8580414026e13617930
AgentTesla
2ff41fc4d08d2049d6c7dcb47b28fcb1e73b896b3e33ee8b95da5a7a3b01a26c
AgentTesla
74c28e96289cef60d4a8c5ff350deff3ad83efb794dcb4a1ec599016c3dbbeb1
AgentTesla
b2acbb9c56fba0cbe5cabd76b5df537059df5644958924ec3ee7d8578666c9ba
AgentTesla
b631c15a2beb5544fd25a832726d1b467b68002efca72ad944f36a627f72ba8b
AgentTesla
bd17aef5a6e188bd70166012321f6e131a403a6b663df81be05d9f104a4718a7
AgentTesla
e83cdeb6387164b1564847119b9a521ba65867bb5f21af600616ffeba26eec1b
AgentTesla
f358d592a02990a899bc4ca7c35804529237cbffac5dcabb3e7e3916a79afbb4
AgentTesla
fdec4f55cde88d88655a58c99ed75bc2218430a32c29062a258ecf7932e548d6
AgentTesla
+ 12'452 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211030-j8fdmabdcp/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6b5acdd22834ac20b8cf15f109cadf0c24e151e85f01ea3d7d56b350a1c6647a
MD5 hash:
7300d3e6e20be432bf06cd730e8f8b16
SHA1 hash:
e1c09a835984f75a92912a54305af2d13646fb24
Link:
https://www.unpac.me/results/6ee97624-91be-453c-b95e-24507231007c/
SH256 hash:
2f504c80825599a489d6ac097fe88de0e630f673f22ec8cae47ff0709a3f4194
MD5 hash:
e3c906d1617ced50804e39e2240fbb9d
SHA1 hash:
8bf5af66731d69fff49fb8f2419b57fe5305edfa
Link:
https://www.unpac.me/results/6ee97624-91be-453c-b95e-24507231007c/
SH256 hash:
7b4ba24781e21b310e2749bc2f7a80b9670a4198a54d26e42079a6a1c1be6ae7
MD5 hash:
7b77d210bf6b00fd8ee8187198852052
SHA1 hash:
7f78d6294a269349fc9a49ad3c8ccb3c3d2665b4
Link:
https://www.unpac.me/results/6ee97624-91be-453c-b95e-24507231007c/
SH256 hash:
726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c
MD5 hash:
06de5d7a4d6459a95b3027489fb6c169
SHA1 hash:
462fbadc94dd49cd20b6b58c34dffaa3d13d49c4
Link:
https://www.unpac.me/results/6ee97624-91be-453c-b95e-24507231007c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 726efd10333dd1cbd4c65e94122f9e05e3d9ccf0ff1caed8ddb421f37689283c

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1729312/

Comments


Avatar
zbet commented on 2021-10-30 08:19:52 UTC

url : hxxp://193.169.255.220/aut.exe