MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78678b92db1df8ee740815b198155f659da807163206769ddfae9e69571cd00f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78678b92db1df8ee740815b198155f659da807163206769ddfae9e69571cd00f
SHA3-384 hash: e3509ba1501e61635631a8946492f5ff6a379b2eebec5afa0e054e1e5e3b11ce4e6af01cf054dec1f706290102bb93bf
SHA1 hash: a33d9fe05e347db7d46528a5b70bd8612c2a5d11
MD5 hash: 6ae5c7eb46800c99305bdd568fbe9c74
humanhash: summer-kansas-xray-batman
File name:TT Copy MT103.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:632'320 bytes
First seen:2021-09-28 17:50:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:WKwk/FKaChDtOcYSi+bBo/Hgypj0nofzuAWJC9HSO2CItWIHVv40beVS4:BBmSGKY0jgrZJSHmI0bT4
Threatray 10'395 similar samples on MalwareBazaar
TLSH T146D4BFA532789977CA7A42F4D89A54C043F0A227538EEFE5DE8164E96AC7775CB0300F
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://onedrive.live.com/download?cid=4C982016C3A5FF5C&resid=4C982016C3A5FF5C!406&authkey=APWl1yweh0InEuU
Verdict:
No threats detected
Analysis date:
2021-09-28 07:20:32 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/6ece1b11-db92-44ac-b012-6b0390dfcfdc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192698/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b04536a1-e478-456b-8a62-091f25cf0e00
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860144
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 492577 Sample: TT Copy MT103.exe Startdate: 28/09/2021 Architecture: WINDOWS Score: 100 36 smtp.mail.ru 2->36 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected AgentTesla 2->48 50 Yara detected AntiVM3 2->50 52 6 other signatures 2->52 8 TT Copy MT103.exe 4 2->8         started        12 newapp.exe 4 2->12         started        14 newapp.exe 2->14         started        signatures3 process4 file5 34 C:\Users\user\...\TT Copy MT103.exe.log, ASCII 8->34 dropped 54 Adds a directory exclusion to Windows Defender 8->54 56 Injects a PE file into a foreign processes 8->56 16 TT Copy MT103.exe 2 5 8->16         started        20 powershell.exe 24 8->20         started        58 Multi AV Scanner detection for dropped file 12->58 60 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->60 62 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 12->62 22 powershell.exe 22 12->22         started        24 newapp.exe 12->24         started        signatures6 process7 file8 30 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 16->30 dropped 32 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 16->32 dropped 38 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->38 40 Tries to steal Mail credentials (via file access) 16->40 42 Tries to harvest and steal ftp login credentials 16->42 44 2 other signatures 16->44 26 conhost.exe 20->26         started        28 conhost.exe 22->28         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/78678b92db1df8ee740815b198155f659da807163206769ddfae9e69571cd00f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 21:00:00 UTC
AV detection:
20 of 27 (74.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbtyxew3dx4o45aicwyzqfk7mwo2qbywgidhnho7v2pgsvy42ahq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c3ef554c48aa01b43adcb2364a42ea8fc7818935b1bd7b0c1746105a9b3546d
AgentTesla
4541c2877fc9c83ea79a96a3891230c3502089583e0727953edfd6dfa3c9f8af
AgentTesla
494adb556681ce8829e36de92073d5a16dabf3f652a5a0bec78d945b63d85823
AgentTesla
71ef0b42f897191454e753376af8344c620e270c305a4e23bbab49581561f597
AgentTesla
b032521341d2f76b1fe69ead761ce67c48fd4ebc7c4ecdb4e7d81dc8b9935e1e
AgentTesla
c57eb942c3be77e27714165608f64a9a3835e5c92b64d69279317a93559b3257
AgentTesla
c5f839f2589841bd77bc1b7b403d9d8780bd303fb4d0060cb1733c276f7b1198
AgentTesla
c7f4ad3987c2026cd2051b487f34e9f2a56249dc319ab066497be27e01a2ea6e
AgentTesla
dc2c0f9073eec40436b96d17e10ff594d586d5856892d922572b76a53f6393b6
AgentTesla
+ 10'385 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210928-we5smsceem/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
b5afbbb05bba925fb4c79230b32985cfdf0c9d727fd426577f147b1c901f18b6
MD5 hash:
93b3a33650e1d23846a5b8b074443c6d
SHA1 hash:
f6329cf2c1e92818c46580596ecfbd913ff53a95
Link:
https://www.unpac.me/results/8aec2c49-379e-4d31-b39a-3a0d254eaca2/
SH256 hash:
466ad550be1d509b6dcd942cdcde3e98d6118fed3f9ca5fd0bcfd72ce7caba9c
MD5 hash:
6ca350ae0b4ea5d048a7379e8eea5143
SHA1 hash:
842494b37a0e61d2459e8b310e0d3f50d3cb4670
Link:
https://www.unpac.me/results/8aec2c49-379e-4d31-b39a-3a0d254eaca2/
SH256 hash:
6b29ac9c982563b57bd5a5df269ead9fb412114667b0061e0c78a5b5cd3588e2
MD5 hash:
da90db8772a346a30193e4be2aa4e744
SHA1 hash:
2afc74e44a7bd91f324a2ab9c9bb350508b49472
Link:
https://www.unpac.me/results/8aec2c49-379e-4d31-b39a-3a0d254eaca2/
SH256 hash:
ba1deea9b52d44e2274f5ee3b283f351b9ef773938120f64798ebb71eba59ad9
MD5 hash:
ea5a8007be0eae1e1c87db694467a439
SHA1 hash:
23d37435cf0842d0aae6c18aee1a3dab0996832e
Link:
https://www.unpac.me/results/8aec2c49-379e-4d31-b39a-3a0d254eaca2/
SH256 hash:
78678b92db1df8ee740815b198155f659da807163206769ddfae9e69571cd00f
MD5 hash:
6ae5c7eb46800c99305bdd568fbe9c74
SHA1 hash:
a33d9fe05e347db7d46528a5b70bd8612c2a5d11
Link:
https://www.unpac.me/results/8aec2c49-379e-4d31-b39a-3a0d254eaca2/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/78678b92db1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78678b92db1df8ee740815b198155f659da807163206769ddfae9e69571cd00f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/192698/

Comments