MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62
SHA3-384 hash: c46a178469146eccd14d78cf149ceb820d728efe0043895589ce193ed568853f80e1057813b291ea6aebc7c16249e2f2
SHA1 hash: 8f4a2f99c5ce5d242645ebe68a709ecd923d34f3
MD5 hash: 20b84abbc810bfc19d177b27d1105721
humanhash: mountain-oregon-sodium-earth
File name:73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62
Download: download sample
Signature AgentTesla
Create hunting rule
File size:961'536 bytes
First seen:2020-09-15 11:04:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 471772127a33258cfe3f224966954ae7 (5 x AgentTesla, 5 x MassLogger)
ssdeep 12288:hoRXFO85PEKTm9NFDemwzuV59YZVDYH+gTy6hfsn8j7TySlampYkTVLV2NYcba/V:h2c85Pm9NFDSuJeOb+nKvyEayJLV8e/V
Threatray 9'408 similar samples on MalwareBazaar
TLSH 17156913B2AC4E3ED1E21638683BD6B09935BE332D2799453BE0EC0C7E3565539662D3
Reporter madjack_red
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/60376/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Siggen2.55190.19338.32129.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/466412
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Delayed program exit found
Detected unpacking (changes PE section rights)
Drops VBS files to the startup folder
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 285619 Sample: qi4TdKklEZ Startdate: 15/09/2020 Architecture: WINDOWS Score: 100 38 Multi AV Scanner detection for domain / URL 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Machine Learning detection for sample 2->42 7 qi4TdKklEZ.exe 2->7         started        10 wscript.exe 1 2->10         started        process3 signatures4 52 Detected unpacking (changes PE section rights) 7->52 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->54 56 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->56 58 5 other signatures 7->58 12 notepad.exe 1 7->12         started        15 qi4TdKklEZ.exe 2 7->15         started        17 qi4TdKklEZ.exe 7->17         started        19 qi4TdKklEZ.exe 10->19         started        process5 signatures6 60 Drops VBS files to the startup folder 12->60 62 Delayed program exit found 12->62 64 Writes to foreign memory regions 19->64 66 Allocates memory in foreign processes 19->66 68 Maps a DLL or memory area into another process 19->68 21 qi4TdKklEZ.exe 2 19->21         started        25 notepad.exe 1 19->25         started        28 qi4TdKklEZ.exe 19->28         started        process7 dnsIp8 32 mail.hybridgroupco.com 21->32 34 hybridgroupco.com 66.70.204.222, 49728, 587 OVHFR Canada 21->34 36 192.168.2.1 unknown unknown 21->36 44 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->44 46 Tries to steal Mail credentials (via file access) 21->46 48 Tries to harvest and steal ftp login credentials 21->48 50 Tries to harvest and steal browser information (history, passwords, etc) 21->50 30 C:\Users\user\AppData\...\IJCARGO(PVT)P.vbs, ASCII 25->30 dropped file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 07:41:32 UTC
AV detection:
42 of 48 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=onbe5z25ijmewn2qrff2quhbdpvju6ilimewdzcjp73jx7jp3rra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1328e0030337b326a962b3369cc8dd2b474de98267e8e9fdc3684f4e5ecb9984
AgentTesla
1452240af7843be04730a070e2d541d37c30a6966c753305fc1e117c165996b9
AgentTesla
602539024550629c94790807ab0f6b99379a53767b14375963e64b71a2185408
AgentTesla
65bdf218a95af52100c20e6f146a7acf16aa0ed0a34ddc7f4a68c66554b648da
AgentTesla
a84cf81fa2d7790ea8f5d59354fa47d2067a12c89c2d975ee2f3b9547765be1e
AgentTesla
a9103ccf2939a9a9b54d8c50aa993af6fcf3ddda4e0491f1987fe09a83f98ab3
AgentTesla
ad7db1393e62d89dcb0039aa5ba64a897e88d3f6b76d146ccf419e952e57c317
AgentTesla
d169af713aac6178816694e1006b2e9f6411687fb13ed0402792222d380624f1
AgentTesla
d2bb06dc3882c72e26ed7598fee37d128955c229246225ed393d90bd2a4eb1dd
AgentTesla
d3168e892cc0eac2e010fa380fd64aae8c55acddb06344b543a6fb0cc05e8dd3
AgentTesla
+ 9'398 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200915-vfv4twg2xs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/60376/

Comments