MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f
SHA3-384 hash: cbd06c4f058fce31251cc1d537a61321e49973d9ae6571046684c07d5f6b975d89a7b828b0d10b9a21639e6913fd0e72
SHA1 hash: e65b3dd978bb75089d9ae82ab074fbf4f1b42fd6
MD5 hash: f33ef1f7bf7e283d2b9fca017c9231a2
humanhash: social-kitten-thirteen-kilo
File name:SWIFT.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:775'680 bytes
First seen:2020-09-25 09:24:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:kCy++re2vR6v1aga67mynlbUGyk8Uc5xz/gJX8d+apDBjVLRPzy:kfRrbfBsnP8UIIMdlpDzlPu
Threatray 9'848 similar samples on MalwareBazaar
TLSH ACF4AD2131623B4AD17A8BF40219B472C3F358556632C6587F8B21FE97EABD03E61B47
Reporter JoulK
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/65755/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42595.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Moving of the original file
Stealing user critical data
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/474928
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289911 Sample: SWIFT.pdf.exe Startdate: 25/09/2020 Architecture: WINDOWS Score: 100 58 Found malware configuration 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 Sigma detected: Scheduled temp file as task from temp location 2->62 64 11 other signatures 2->64 7 SWIFT.pdf.exe 6 2->7         started        11 YYtJku.exe 5 2->11         started        13 YYtJku.exe 2 2->13         started        process3 file4 34 C:\Users\user\AppData\Roaming\RRIfFAt.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\...\tmpE40C.tmp, XML 7->36 dropped 38 C:\Users\user\AppData\...\SWIFT.pdf.exe.log, ASCII 7->38 dropped 66 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->66 68 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->68 70 Injects a PE file into a foreign processes 7->70 15 SWIFT.pdf.exe 2 5 7->15         started        20 schtasks.exe 1 7->20         started        72 Multi AV Scanner detection for dropped file 11->72 74 Machine Learning detection for dropped file 11->74 22 YYtJku.exe 11->22         started        24 schtasks.exe 11->24         started        signatures5 process6 dnsIp7 40 us2.smtp.mailhostbox.com 208.91.199.225, 49735, 587 PUBLIC-DOMAIN-REGISTRYUS United States 15->40 42 192.168.2.1 unknown unknown 15->42 30 C:\Users\user\AppData\Roaming\...\YYtJku.exe, PE32 15->30 dropped 32 C:\Users\user\...\YYtJku.exe:Zone.Identifier, ASCII 15->32 dropped 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->46 48 Moves itself to temp directory 15->48 50 Tries to steal Mail credentials (via file access) 15->50 52 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->52 26 conhost.exe 20->26         started        44 208.91.198.143, 49760, 587 PUBLIC-DOMAIN-REGISTRYUS United States 22->44 54 Tries to harvest and steal ftp login credentials 22->54 56 Tries to harvest and steal browser information (history, passwords, etc) 22->56 28 conhost.exe 24->28         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 14:20:22 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qd7a2mdzj6edcuskyyyj5ucyrnviroc2erhnezw2jsoxvexd52pq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0de02fe1d36c7dc18f12a9eb8c398158c474699f8471177b2b2d190b6c0ce3c5
AgentTesla
3081a88581628513f3aeeb4a8a1749302968130017accaef9494458553d19091
AgentTesla
35912ff3b78d0699082450202cc16cec5c11447c39ec0e4db7738c188662f0c5
AgentTesla
4f4da7ed9a3d252b36eb7231d63b5e05eae88bec7edaa044fb5590e49d8db950
AgentTesla
636ed47033dc0066e0e169d4be9d01b56886b255cd5d351b481e35200f507b43
AgentTesla
89116942312d8a60d9dff7624d4550b1f84def97b0251cb705e705e1d125edcc
AgentTesla
8f004bc9aec06467c6d02274e540d990f49f936a089fe46c651fe80b38b5a4cd
AgentTesla
af3de18f3b36685688f53991f1c4bd26d2cf0a36f7aeccaa0a09088b9c2e9461
AgentTesla
f13afdd20e5dbe1fe6bc73b81b8c91604d125a1833b6a14fb9efbeb575ec73ee
AgentTesla
ffc5491643c07ce077831156a0e1d74fbcf18f8826a8b78fd95dfa5282fc3e90
AgentTesla
+ 9'838 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200925-wh5bc3sfqx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f
MD5 hash:
f33ef1f7bf7e283d2b9fca017c9231a2
SHA1 hash:
e65b3dd978bb75089d9ae82ab074fbf4f1b42fd6
Link:
https://www.unpac.me/results/80d20efb-bbc8-4b8b-9641-f10b16e5e942/
SH256 hash:
d93986610e9cede36e1688163561b8604d0fed71a19f24c42abdc651035584b0
MD5 hash:
2dd62ac2d322df1fd9b281858c890525
SHA1 hash:
2daf529ec31305aa14d535a14abfdb96d3c00cf3
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/80d20efb-bbc8-4b8b-9641-f10b16e5e942/
SH256 hash:
7d88a759cd6fd484a9c018845a1f02a8078994241f7e6520a62ea9f0c0fd8380
MD5 hash:
57815839c6e0fdac8b2037a5bd9de178
SHA1 hash:
73a1382372aacf2d70330583f66c03c6ef325884
Link:
https://www.unpac.me/results/80d20efb-bbc8-4b8b-9641-f10b16e5e942/
SH256 hash:
729a1b125fb330463c22a87c061e384300f49bd9d6793836bb3e52bcb61cc03f
MD5 hash:
ac3f427e66b28b013b0b651c2f71d1e9
SHA1 hash:
ddf8b4b1d36aced75740632b41d30add06b5db3d
Link:
https://www.unpac.me/results/80d20efb-bbc8-4b8b-9641-f10b16e5e942/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 80fe0d30794f8831524ac6309ed0588b6a88b85a244ed266da4c9d7a92e3ee9f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/65755/

Comments