MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f
SHA3-384 hash:	bab7772b90a34bfe4c7e6d68afe8509bd3ebacfc5b94f9970acab05ed6aedc4d833d324b928b01cc901f2bb83fc8cf2d
SHA1 hash:	3b7ce894ee0498a631e2a93ff7225dbcf63a5e4e
MD5 hash:	100ed816a33f33cd87993d1b77c14192
humanhash:	chicken-green-mockingbird-nineteen
File name:	100ed816a33f33cd87993d1b77c14192.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	755'712 bytes
First seen:	2021-07-14 15:14:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:gEQUCGHiZaArhu+8+XWGRWL83205HPp1f0ve5yOaIfMm7F:gEQUMaAI+8soo205HPp1kTOasME
Threatray	6'781 similar samples on MalwareBazaar
TLSH	T166F4CF3723844727CBBE46B9B650E050F761A8ABB701DE0F1AC372D25A7B70055DAD2E
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

100ed816a33f33cd87993d1b77c14192.exe

Verdict:

Malicious activity

Analysis date:

2021-07-14 15:52:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9a68099e-8ced-4407-9b5a-4b256e3a5176

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/171727/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.5506.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c662d1cf-724e-4b08-93b2-5703df3bc4a6

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/816490

Signature

.NET source code contains very large strings

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-14 13:28:33 UTC

AV detection:

20 of 29 (68.97%)

Threat level:

5/5

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

4dad4127df36f1ff3db7fd7dcc70e776f043cb621e3ec297551ad1e187dae0a6

AgentTesla

5defd50046db301c82c85cc8306960982f576cbf5446f24062cc570dcf0becec

AgentTesla

61060fa22e8fe8c29f2cd7b2b4b9bc4d350fc9331a6dfcbc2f873bec00f6818d

AgentTesla

69f4101e63fdfdec4a5b6fc4a778619a69f9511416dd90fe9df33502ff8d9d4f

AgentTesla

7295a582fe88bca9f42f2849c9d40ceeff3006c1911dbb08e6ecf02f20cfa60a

AgentTesla

8011e22f056cc3a11f8e32fd6b122631e76f254c9c32eec5f2381bc5881dcbe6

AgentTesla

80bd30aa05237c35c46fc461f06d04b3a5b4ae90380287125ad011a605ef6298

AgentTesla

afb762081ead1cb5e87f45a39cd16a6875e901eb1d5ab40b978c25fe549d2662

AgentTesla

f6b40a9f7994dce755f76caea85e0d283cfa671d7b508729d6a70a4fe092b830

AgentTesla

+ 6'771 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210714-s498g5k3r6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Malware Config

C2 Extraction:

https://api.telegram.org/bot1848104837:AAGyG0hi_VP31PmMNbynbZPjJ66-QVsVr2Y/sendDocument

Unpacked files

SH256 hash:

c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b

MD5 hash:

0327d1374a5ce015ad9c83c5de76e823

SHA1 hash:

e521349d9e96a4191248747c42c78b6f88fc8f63

Link:

https://www.unpac.me/results/3ccd18b9-d0d7-4bd1-8f51-6a925e89839f/

SH256 hash:

eb83df8fdffdce30abca7128247471a3438f4b2ecea3d05c6aa22a72db3d75e4

MD5 hash:

be4c543ca05b2277385ecb0ba9085a7f

SHA1 hash:

56039ea7b2eb8f22d4c8a1a3e51e68f7cc5972c1

Link:

https://www.unpac.me/results/3ccd18b9-d0d7-4bd1-8f51-6a925e89839f/

SH256 hash:

86e0ba817d6702fae27d2d806abb1c064185986af473f4b3d448ae918bd6bb68

MD5 hash:

6ba5f3d0a3a5bd9d3911c1ad694d3b8c

SHA1 hash:

24665c5d75a65d761a43c2ccdbe77d31f8c9165c

Link:

https://www.unpac.me/results/3ccd18b9-d0d7-4bd1-8f51-6a925e89839f/

SH256 hash:

7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f

MD5 hash:

100ed816a33f33cd87993d1b77c14192

SHA1 hash:

3b7ce894ee0498a631e2a93ff7225dbcf63a5e4e

Link:

https://www.unpac.me/results/3ccd18b9-d0d7-4bd1-8f51-6a925e89839f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7320273731dbce41f47cc62a196383cbe81764c7285277c153498818d1135b8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.