MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210
SHA3-384 hash: f5d003d76f569948ccce87ff75b10f1fe7a49ffd8d24cee6ed9920c0789ae454c487acb49b8d6b48846ed9f06eefdb96
SHA1 hash: d673ca53a78d0eb1ec9dda91d8b41efa398ac531
MD5 hash: c06d27504bf4dcd535eda773c5d292a6
humanhash: blossom-quiet-ohio-island
File name:ricevuta del bonifico.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:129'024 bytes
First seen:2021-04-26 05:50:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:pS2EWXZY49wU0ihN/BJLcck0a0Eww8app0BqEAq/4H7/8/4wS/Oz4p4Pm7C8pp4I:ky+49w6NJJY1mEh
Threatray 4'347 similar samples on MalwareBazaar
TLSH B4C3A4B97FF16E7BC6DB1276EC743E58807125C24F37A20471993A085FD2A27A94CC1A
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ricevuta del bonifico.exe
Verdict:
Malicious activity
Analysis date:
2021-04-26 05:54:14 UTC
Tags:
trojan dtloader loader
Link:
https://app.any.run/tasks/f9b0f0b1-1950-4355-a5de-318edb0425e5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/144183/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.31227.24628.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending an HTTP GET request
Creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
HawkEye
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a7e9e00d-2b33-439b-ab14-6875d393c844
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/697494
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 397667 Sample: ricevuta del bonifico.exe Startdate: 26/04/2021 Architecture: WINDOWS Score: 84 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected AgentTesla 2->30 32 5 other signatures 2->32 7 ricevuta del bonifico.exe 16 7 2->7         started        process3 dnsIp4 24 xwjhdjylqeypyltby.ml 172.67.176.229, 49711, 80 CLOUDFLARENETUS United States 7->24 10 powershell.exe 22 7->10         started        12 powershell.exe 26 7->12         started        14 AdvancedRun.exe 1 7->14         started        16 2 other processes 7->16 process5 process6 18 conhost.exe 10->18         started        20 conhost.exe 12->20         started        22 AdvancedRun.exe 14->22         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-25 22:41:24 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkjsff6ohk2qvcmqwerklfvpuhkcfh5uobao5iijgt3sbqno6iia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
126f752c7dec6c513804a0737e5d0a03cd8a1082923d68aec35979f3a7db7d60
AgentTesla
174d9ba2e89f897d84a612d59117d349773c91f129aa8cdb8ad8a29d576fa8af
AgentTesla
321b6f97457bc64a7fa264043d5f7ce3b6dc1ddd735daf77820580b2f7ff7a93
AgentTesla
337a895245dcdbe522c4320dbe1dfd62e346aecad8246f9b895a5460211865b0
AgentTesla
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
AgentTesla
5242c4552e512707dbeb3b004cb441cc140b6cfe813a4d6532f4adec03bcb23c
AgentTesla
65a37fc31e46339de5ede41f1976ee5860f9c54573a510b6a73789c9ece66588
AgentTesla
6721200d1e880c83cf3c4ee07db918abca886251cd59a10c10b515eaf026bbbc
AgentTesla
dea2e88e71d3b38500aca694a9ba1f476d8db14e5389a2cf70b23cad51eb33c9
AgentTesla
f9aa96b16ed15eeee83a9c47c1e682106d44281ea8d030e6cb1691852253aad6
AgentTesla
+ 4'337 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210426-y39v94lt1s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
Executes dropped EXE
AgentTesla Payload
Nirsoft
AgentTesla
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210
MD5 hash:
c06d27504bf4dcd535eda773c5d292a6
SHA1 hash:
d673ca53a78d0eb1ec9dda91d8b41efa398ac531
Link:
https://www.unpac.me/results/6f1433ad-2d3b-4647-806a-7cacfe2a9f5c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/7a932297ce3ab50a8990b122a596afa1d4229fb47040eea10934f720c1aef210

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/144183/

Comments