MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06
SHA3-384 hash: 406ce6779ab5662495ab079f92a822fef9b4ba85e2aed94b692ca051420a70a29e90ad723c7e3a0c978dd510b9c00131
SHA1 hash: 4ee4590a9e770a6b1c6060d72fc6c32cd6cac221
MD5 hash: 6f135efd582f0778dff4820e18b8aacf
humanhash: london-william-magnesium-bravo
File name:UPDATTED S O A -49565467G.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:750'592 bytes
First seen:2021-07-14 06:03:38 UTC
Last seen:2021-07-14 20:55:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:RZQUCQSmAojYGrYBpsmJ/i3wGJGmrLrV9pBV/cYxuPu27WNqu:RZQUiGecAGsmjzZEaL27mqu
Threatray 6'725 similar samples on MalwareBazaar
TLSH T1B7F4CF2733844727CB7E42B97640E091F7A1ACAB7701ED0F2AC372D64A6B70195D6D2E
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
16
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
UPDATTED S O A -49565467G.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-14 06:06:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5b37655f-8f47-454e-9c6a-6140428255af

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171557/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.5506.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35967f03-b289-446e-93a3-9048329a5c26
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816011
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 00:38:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=op2z4ssv4yyk2tjnjunnfqojdcqpog6yuculnkv2lswtps4rhida._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
33a6628f2299ddd680f5ec1ace12c4fb5f1740ea254af834d4a0e370a2dc65f9
AgentTesla
73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06
AgentTesla
a8f607760c06f41b0f68f04f39cfde6da7c9c9049dd816e38ed9b36ace8941a9
AgentTesla
aa96c47b83f9d2587bb97b14d4913dd014af264ac02047da088ba70cb0ebe167
AgentTesla
c17909d1f387c94a96bad3d21b9cb39f8beb6ca96e373a009dd6ad11354d252c
AgentTesla
d77323bce2adab1c82d813a33539848b13f237efee6c8fdacffb2ba88fcf6051
AgentTesla
faca737d4aa23d55f6d5e25ce2b47f8f5060b8b62aa472073de85c50a21347d2
AgentTesla
+ 6'715 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210714-7w3r86c1es/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/1986ae3c-ddde-4ba9-b8da-b8ab0586030d/
SH256 hash:
a2c6b6252ee3a8cb4eea78d1e9ec51c9b30e65d7b6f7cb8e484986104695fbdc
MD5 hash:
bb9e3711a6e89b077c96b0043d11c4a2
SHA1 hash:
a0cbca44e13a6cb895169f911ba6cf523c02a8d5
Link:
https://www.unpac.me/results/1986ae3c-ddde-4ba9-b8da-b8ab0586030d/
SH256 hash:
839c0bc11df453df3d9ad6aa0bdd5c2c457dcd55c3bfcaefcd8ca44eabebf389
MD5 hash:
2d2cc56e03be87c002c98a96589bc7d1
SHA1 hash:
2f9a636434ec3dc89eef5d727960aa588af5cc2e
Link:
https://www.unpac.me/results/1986ae3c-ddde-4ba9-b8da-b8ab0586030d/
SH256 hash:
73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06
MD5 hash:
6f135efd582f0778dff4820e18b8aacf
SHA1 hash:
4ee4590a9e770a6b1c6060d72fc6c32cd6cac221
Link:
https://www.unpac.me/results/1986ae3c-ddde-4ba9-b8da-b8ab0586030d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.73
Link:
https://yomi.yoroi.company/submissions/73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2eb4a6d6c862c2c885d510992183534887334fa9b2b5469f27e84f92d49065c4

AgentTesla

Executable exe 73f59e4a55e630ad4d2d4d1ad2c1c918a0f71bd8a0a8b6aaba5cad37cb913a06

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2eb4a6d6c862c2c885d510992183534887334fa9b2b5469f27e84f92d49065c4
  
Dropped by
SHA256 b7561cc2fcd2d9f668a4d6127ded0a4d9b7d2bc47fa60bfc1e56d6d25120251d
Cape
Cape
https://www.capesandbox.com/analysis/171557/
  
Dropped by
SHA256 3e46e3f9e2106336a775eb58ef19df08b37035ddb27eceb9e7581fbd8d134055

Comments