MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a
SHA3-384 hash: a498b97f2acc39823a4cd93230c83b2d02fa326dcfa13a15e50f3f4a1fba5cfed270d5cae7df53adbfcfba2458d866b3
SHA1 hash: ffaf1cc07410b39b7fdc5a19718720e0941385ce
MD5 hash: fb5fdfd5aaaade83d77110e4c5accc03
humanhash: summer-three-equal-jersey
File name:SWIFT.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'752 bytes
First seen:2020-11-26 16:11:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:jGb4JO3VrN2iNMLnstkIoD7WHKv1Gsfv1M66roHIt8LF:Cb4JO3BN1gnnuH61Gsi6Xs8
Threatray 1'537 similar samples on MalwareBazaar
TLSH 2CB4F1322692BF96D7BA4FF1E56122400FBC7D679620E61CBDCC01CE2271B589A15B73
Reporter cocaman
Tags:AgentTesla exe SWIFT

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/105750/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/548364
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 323287 Sample: SWIFT.EXE Startdate: 26/11/2020 Architecture: WINDOWS Score: 100 31 Found malware configuration 2->31 33 Multi AV Scanner detection for dropped file 2->33 35 Sigma detected: Scheduled temp file as task from temp location 2->35 37 6 other signatures 2->37 7 SWIFT.EXE 6 2->7         started        process3 file4 23 C:\Users\user\AppData\Roaming\WWjdPA.exe, PE32 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmpF6A3.tmp, XML 7->25 dropped 27 C:\Users\user\AppData\Local\...\SWIFT.EXE.log, ASCII 7->27 dropped 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->41 43 Injects a PE file into a foreign processes 7->43 11 SWIFT.EXE 2 7->11         started        15 schtasks.exe 1 7->15         started        17 SWIFT.EXE 7->17         started        19 SWIFT.EXE 7->19         started        signatures5 process6 dnsIp7 29 mail.grandtours.gr 95.216.7.161, 49759, 587 HETZNER-ASDE Germany 11->29 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 21 conhost.exe 15->21         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 06:00:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=outew2v2eca36afvorfb46hqylgjgo5aga3s5lk6ocyxqptetzfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
244625ba9b6e1ed62d3db06416705c6c7c2feff9d82e3e9711a0636bee5f29f2
AgentTesla
40fe69be55041a8607bf2596d0fa649ab26f6d6bd6973fb955f14f4e8a066b6c
AgentTesla
4415d19e0b69bdccf79c937db6fe491c4875367cc3ad808b233fa606c708c18b
AgentTesla
ae6c488302c04f00a60835db6b955fb8e1eb42f0e73e71873f5b7dc630596755
AgentTesla
b6ef61b5ef75d64fa64bac880af715c9f66c8a4a6a1f352e8183e82e91b698c0
AgentTesla
bacbd1e1b139791f7ca8eeba6a14cf7b34c9c010aca5ce7eb527aea212448868
AgentTesla
d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f
AgentTesla
e0bf431e6a5290be917784e83d5641db358d73b72cb2caa7ce1f05a5542da8c2
AgentTesla
f148b6ad99c39c47a48a82fc4959b98ccfed28b35556ea3e0f07d0b8911d5e15
AgentTesla
fe0fb21a7669d885fee457ce696d2a5096da1a9b4bcfe6e06b5f0d58ac4a12f2
AgentTesla
+ 1'527 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201126-tgypmc6yga/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
91da4cb46ab9e5bc6641866605046a8700dff87500181ae9fe41256a4424195b
MD5 hash:
45295af4cae0cd4ffa0a10cf8bb23d98
SHA1 hash:
d5f28edae0ef6f7fb406c88452c465ae337fedc3
Link:
https://www.unpac.me/results/91b9b410-22b3-4b25-99c6-630e3506a659/
SH256 hash:
44bfc1411f83b5a014e82099c49ccb5a5bdaf6e65271e70fa9396f3de08d3013
MD5 hash:
d8a0c623f0b66d2713e1723118684656
SHA1 hash:
b28ebba63d6a403854dca834e29eacec09c1e091
Link:
https://www.unpac.me/results/91b9b410-22b3-4b25-99c6-630e3506a659/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/91b9b410-22b3-4b25-99c6-630e3506a659/
SH256 hash:
75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a
MD5 hash:
fb5fdfd5aaaade83d77110e4c5accc03
SHA1 hash:
ffaf1cc07410b39b7fdc5a19718720e0941385ce
Link:
https://www.unpac.me/results/91b9b410-22b3-4b25-99c6-630e3506a659/
Malware family:
AgentTesla.v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/75264b6aba20/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5

AgentTesla

Executable exe 75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 93a44932c9f69503c3c64526fd393f1f880e8d4c902118938e94611f1b8533a5
Cape
Cape
https://www.capesandbox.com/analysis/105750/

Comments