MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971
SHA3-384 hash: b2e69844176fb9824df863da3cd7a7ca29eeade83b67845cba8671efc00c9819d41e212da6f461e03c909e7ed915ed52
SHA1 hash: 05fde031ade66b6e918ef4cf53fc0e9c1871dade
MD5 hash: 7c22cc42613419161faa675ac0976561
humanhash: kentucky-wyoming-spring-carpet
File name:Updated SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:987'136 bytes
First seen:2021-04-01 13:09:01 UTC
Last seen:2021-04-02 18:04:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:2PJ+OpwdkGU/KCYeTdoL6mE0rCOkMzT610RbociSEa/0lkZCu:eDwdkGUyCYl2ntOknehiy0Ju
Threatray 3'760 similar samples on MalwareBazaar
TLSH 2225BE293B20154EC4A636F85454D04C5BE27DA92592C2837EFD3BEB60B2F93CFA415E
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/130926/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/665046
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 381446 Sample: Updated SOA.exe Startdate: 03/04/2021 Architecture: WINDOWS Score: 100 62 Found malware configuration 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 Sigma detected: Scheduled temp file as task from temp location 2->66 68 10 other signatures 2->68 7 Updated SOA.exe 7 2->7         started        11 newapp.exe 2->11         started        14 newapp.exe 2->14         started        process3 dnsIp4 52 C:\Users\user\AppData\Roaming\CKGxzDIw.exe, PE32 7->52 dropped 54 C:\Users\user\AppData\Local\...\tmp71CD.tmp, XML 7->54 dropped 56 C:\Users\user\AppData\...\Updated SOA.exe.log, ASCII 7->56 dropped 70 Adds a directory exclusion to Windows Defender 7->70 72 Injects a PE file into a foreign processes 7->72 16 Updated SOA.exe 7->16         started        20 powershell.exe 22 7->20         started        22 powershell.exe 25 7->22         started        30 2 other processes 7->30 58 192.168.2.1 unknown unknown 11->58 74 Multi AV Scanner detection for dropped file 11->74 24 powershell.exe 11->24         started        26 schtasks.exe 11->26         started        28 powershell.exe 11->28         started        32 2 other processes 11->32 file5 signatures6 process7 file8 48 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 16->48 dropped 50 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 16->50 dropped 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->60 34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 24->38         started        40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 conhost.exe 30->44         started        46 conhost.exe 30->46         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 11:30:33 UTC
File Type:
PE (.Net Exe)
Extracted files:
30
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qah7uurbg6zphqliblqgiivelojemlqs2bb3ihpsmb7vlbhwtfyq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
02392a754fd967d6ac72ee206b6ac9c3b3aab634abc9c49edb46a6b81ee828e6
AgentTesla
0b02286faa0d5f7a7c239bbb459252a5dbc499562bba488034c75d8c04e29cd3
AgentTesla
1d380dfada55e561b147894bc58c64b6d7f14e44cfd069df0d15dcb2533e4880
AgentTesla
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
611a2dfac3989c66b10815fe8d6a81d92554e0ce47ec3d5b6bdd7c91c4163a7e
AgentTesla
6661acf762423f3241fa87250e9e8e82b270ed2c8ee891f5ca64e62c0140e6b8
AgentTesla
72b63832c576de64ecf5cf7ef03f9658ebd495c9ecac7ce9a3e1bbf7bde38e75
AgentTesla
cbf9d4ef21092210f58ad0cbdd4753dbbf785387dd8f3001014672679196c65c
AgentTesla
d2433dbd7a76e652575d56f53a9ec74e403a66076351b0494ed74f5f2518af2c
AgentTesla
fad59266b34827f994eba36a030a5abd4c552c3132801afec5fe74c787e10044
AgentTesla
+ 3'750 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210401-etfecx56se/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
276a1a0800999b80d42105000217a70fb36f6ec451518c0fc179498c6700f389
MD5 hash:
a596b0e8f6f938943653dfa448a03bb1
SHA1 hash:
12508a85cdd84419e7122be37547fef716f0c40e
Link:
https://www.unpac.me/results/6ffde18c-df3c-4b5d-9147-6b80d86388b9/
SH256 hash:
800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971
MD5 hash:
7c22cc42613419161faa675ac0976561
SHA1 hash:
05fde031ade66b6e918ef4cf53fc0e9c1871dade
Link:
https://www.unpac.me/results/6ffde18c-df3c-4b5d-9147-6b80d86388b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/800ffa522137b2f3c1680ae06422a45b92462e12d043b41df2607f5584f69971

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/130926/

Comments