MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3
SHA3-384 hash: 84ab5ecc7b389f912765237834650141c6e2b4a00d43cf02a51d9579d0bd8846bc58af4355c180225685480714099c05
SHA1 hash: 1ed45f61a8e16f5ff15731075d258fba21fd6e0b
MD5 hash: fef9a9719ee7bc2e48d38ca5514378dc
humanhash: quebec-burger-apart-william
File name:Purchase_order_No_7839004.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:504'576 bytes
First seen:2021-09-28 16:53:17 UTC
Last seen:2021-09-28 19:17:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:urx/lFIFVH7YzglqYvQ4pfTSMiKwyRy7:ylIigwWQiW9yR4
Threatray 10'677 similar samples on MalwareBazaar
TLSH T18AB4F12977849F10D56915B1C5E3873907F2E68B6632D34A3FCC41D24E827E99F88BCA
File icon (PE):PE icon
dhash icon e884030dcedeb4e8 (52 x AgentTesla, 20 x Loki, 6 x Formbook)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase_order_No_7839004.exe
Verdict:
Malicious activity
Analysis date:
2021-09-28 16:56:41 UTC
Tags:
trojan rat agenttesla
Link:
https://app.any.run/tasks/4006f6bb-a5c4-473d-81f5-05419b159c26

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192684/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47059994.9499.12510.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Creating a window
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/50661a65-29a4-4db2-b616-5ebad2a9c5db
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860063
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the startup folder
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Powershell drops PE file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 492494 Sample: Purchase_order_No_7839004.exe Startdate: 28/09/2021 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Antivirus detection for dropped file 2->34 36 Antivirus / Scanner detection for submitted sample 2->36 38 6 other signatures 2->38 7 Purchase_order_No_7839004.exe 1 2->7         started        11 OpenWith.exe 17 6 2->11         started        process3 file4 28 C:\...\Purchase_order_No_7839004.exe.log, ASCII 7->28 dropped 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->40 42 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->42 44 Injects a PE file into a foreign processes 7->44 13 Purchase_order_No_7839004.exe 15 2 7->13         started        17 powershell.exe 15 7->17         started        20 Purchase_order_No_7839004.exe 7->20         started        46 Installs a global keyboard hook 11->46 signatures5 process6 dnsIp7 30 192.168.2.1 unknown unknown 13->30 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->48 50 Moves itself to temp directory 13->50 52 Tries to steal Mail credentials (via file access) 13->52 58 3 other signatures 13->58 24 C:\Users\user\AppData\Roaming\...\%Namee%, PE32 17->24 dropped 26 C:\Users\user\...\%Namee%:Zone.Identifier, ASCII 17->26 dropped 54 Drops PE files to the startup folder 17->54 56 Powershell drops PE file 17->56 22 conhost.exe 17->22         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 17:09:09 UTC
AV detection:
18 of 27 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqxkxgdlhp3xh7p24tcvzr56d4vyg7ouaytobrydri4vjk4qrgrq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
20099b68fc7896261434a79ffe3398f80a268118b180dce7a7af8c9b7260ec58
AgentTesla
2e98800b02e84e6e8b05f9231d83856c992da45d861cecad53575a35b293fcf9
AgentTesla
7dbdfe2fc6efd3197ed404f6de2fba3612c65115375ab0c3409ead24ab4877cb
AgentTesla
8794fb61fde8b1e9639bff39c159e2e54ffe046a0480e017e8a1244cd22d8dd2
AgentTesla
c4a6522be0c7b4f924079e6e69b623bc38a0eb2628db4efdc9a6b87ea35a0675
AgentTesla
e2c5dfe9603d82d089d6401bed1789d0b0c389984f49fd9bc1bcb56f51a47062
AgentTesla
e5429617126423f8569960dc908ad22361cb6ecc933e00083f050f8fba7595bb
AgentTesla
f3e6dcfd4b79c28078de10a6e14385b58a69b73b79986cef7000e88501b7d3ae
AgentTesla
fab0db0c780f0c6699b1acd564580dded6fb1857c61093d732da3bde480cd655
AgentTesla
+ 10'667 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210928-vereksccd6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/1ed45f36-1bf3-4f5e-8e6d-812ab3957b89/
SH256 hash:
8794fb61fde8b1e9639bff39c159e2e54ffe046a0480e017e8a1244cd22d8dd2
MD5 hash:
95c18a998ee6b54fae7d7fef0ccdc00d
SHA1 hash:
76df12e18845dc1c5c5439134c04354b75a326e8
Link:
https://www.unpac.me/results/1ed45f36-1bf3-4f5e-8e6d-812ab3957b89/
SH256 hash:
5cb217c291fc013a5a9802f720088894a277f75357e504203a0f0848a669a14a
MD5 hash:
fed7b97fdec39e04174fa5cdbef0b09b
SHA1 hash:
0076d79e717f4cdc04433dd9a9db92faff1ca39d
Link:
https://www.unpac.me/results/1ed45f36-1bf3-4f5e-8e6d-812ab3957b89/
SH256 hash:
7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3
MD5 hash:
fef9a9719ee7bc2e48d38ca5514378dc
SHA1 hash:
1ed45f61a8e16f5ff15731075d258fba21fd6e0b
Link:
https://www.unpac.me/results/1ed45f36-1bf3-4f5e-8e6d-812ab3957b89/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7c2eab986b3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7c2eab986b3bf773fdfae4c55cc7be1f2b837dd40626e0c7038a3954ab9089a3

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/192684/

Comments