MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f19771f0cacfaf402dde4d1a98b71dbd418d0d83a31d5e233c43cc7da202df0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f19771f0cacfaf402dde4d1a98b71dbd418d0d83a31d5e233c43cc7da202df0
SHA3-384 hash: ad33aec0a2f7eae96dedb7631b61d4454f8e97fffc92ce507964f25d120bb6dc128c2a41a73a9eaea6def7c328597f23
SHA1 hash: 0e8ee14fd9454397d62466401546cd11434e787c
MD5 hash: 26b007315da73294eb06093d2d2e3615
humanhash: nuts-illinois-wisconsin-comet
File name:invoice copy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'302'016 bytes
First seen:2021-06-22 17:43:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:GJZaF9GF2fXXIcXoCXXIcXo0XXIcXov8LarC/bbq8bl83ajC+R6O32DBxD6kUtkK:5jjvRa8Lkc3bGeJEwWRitzqZ+2pppz
Threatray 6'208 similar samples on MalwareBazaar
TLSH 76558E1CA49F9953D3BBFB788AF1BA80E77CA3A07D3FD027053205AED928D891557484
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
invoice copy.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 17:46:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e4fef85c-2138-43ea-aca8-38a8660c68b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167655/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.867-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a2468d54-321c-45ad-92ae-01e21e55c02b
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806175
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 438586 Sample: invoice copy.exe Startdate: 22/06/2021 Architecture: WINDOWS Score: 100 23 Found malware configuration 2->23 25 Multi AV Scanner detection for dropped file 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 10 other signatures 2->29 7 invoice copy.exe 7 2->7         started        process3 file4 17 C:\Users\user\AppData\Roaming\coNJhYqrs.exe, PE32 7->17 dropped 19 C:\Users\user\AppData\Local\...\tmp9A23.tmp, XML 7->19 dropped 21 C:\Users\user\...\invoice copy.exe.log, ASCII 7->21 dropped 31 Injects a PE file into a foreign processes 7->31 11 schtasks.exe 1 7->11         started        13 invoice copy.exe 2 7->13         started        signatures5 process6 process7 15 conhost.exe 11->15         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7f19771f0cacfaf402dde4d1a98b71dbd418d0d83a31d5e233c43cc7da202df0/
Threat name:
ByteCode-MSIL.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 17:43:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4mxohymvt5piaw54ti2tc3r3pkbrugyhiy5lyrtyq6mpwrafxya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
24dd3516bb7537fba691d2486dbbd2daf8729a2ba6fdfc90c7cd353418371390
AgentTesla
31a89c6783fa15dd53d37d649b2b870a217736e8793ec70ad9604ab8731092f4
AgentTesla
4eaefd6f0e650e017e1c63205fd41f9f557568b15bf75afe80cfdf923fe114e5
AgentTesla
98ca7ed2b77463b05ef9a753d9ba31fe37f30b509907db0d3d603f5e6920be1b
AgentTesla
99b15a06fde9d70d6ca003ca1ef28cdfc503b40f03f20831290229447304b21b
AgentTesla
b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5
AgentTesla
b1bbe8202c60b81262815ceed78ac80573eebec5ba82bb8660ca3bd331b4c33e
AgentTesla
b4f0d107e95fa6f3aaae96d0341f0f0ad90b2dfa1fe7d9e04903eb2354a39ded
AgentTesla
b8d1ed4f810b98ad1e086962a2ba39f923602a061944417884a30de92513e786
AgentTesla
bbee4ab51a06aaf747ec552090ebd3445c12407c1b7bd4301233ee1f4ed2fe0a
AgentTesla
+ 6'198 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210622-ey4yhmvya2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
7f19771f0cacfaf402dde4d1a98b71dbd418d0d83a31d5e233c43cc7da202df0
MD5 hash:
26b007315da73294eb06093d2d2e3615
SHA1 hash:
0e8ee14fd9454397d62466401546cd11434e787c
Link:
https://www.unpac.me/results/9d112247-ab68-4536-903e-c03fbf561caf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f19771f0cacfaf402dde4d1a98b71dbd418d0d83a31d5e233c43cc7da202df0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/167655/

Comments