MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87
SHA3-384 hash: 4c5330b91496f9223fe0f6e29f60b4485b0e96af7788ec120f381ed8e4727e10d8483335072fb19abb1281b1b02bd92b
SHA1 hash: 04e3fb7fab96b7711baa671a7dbb913b66d2be71
MD5 hash: 395db038763e2172675694d317b2d7a8
humanhash: uniform-paris-juliet-purple
File name:RFQ No49958 Led Farm Pty. Ltd New Order.PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:783'360 bytes
First seen:2021-07-01 13:37:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:EQmE0SBbX5TyLCFC2IXw8gl7tG+6ZdwajbxZfYha52:9HqCFLLl7t56ZSajbLfz
Threatray 6'281 similar samples on MalwareBazaar
TLSH 3AF48D241DA94025F9F94FBD8AE060B257AEBE232F139C5D24F23EC13733681D9A156D
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ No49958 Led Farm Pty. Ltd New Order.PDF.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-01 13:42:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/89780c37-fa15-494e-9d6d-97b1a1433729

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169163/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.13402.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/17bd054b-d705-4f38-8fb7-9c0a091228fa
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/810573
Signature
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-01 13:38:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qeydyhm363enfdxgrotbjlfw44yyhmdeu4dvr4wnxqli6i6vfwdq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
5a3fa956c8c6f4c56393717e712e7ce7a9876274388257361b4ce4196c190330
AgentTesla
5b293ca70449d8da04fc704635e04b266290b5591ca49ef4a29e7ae1d656640c
AgentTesla
69710a605be0e7ffded4a0156f7823e29dc0f1b2ceff785465d3fd094802de07
AgentTesla
71fd63bae4cdf372d6a451850a966e026ec87445abf9d802bfc8ea8f8c35c529
AgentTesla
88ab1c44d2799f7d670ba6996bbcbe3d2fe19300957811802e2452e31c415a49
AgentTesla
8a1ceb6687babe6ab82a38ca344d1092a7fc9bd6dbaf3420a3311c50131928ef
AgentTesla
8bc25adb8d1b8d86275ab9c85cb619deae71b1694809ee9f14f11a03dd6b739a
AgentTesla
d7b5d58447351c4c9708579d918d42a05bc8c9da9ea8f074a37c4f60a57b05b5
AgentTesla
e2efc9d3d3132046d0567a2198ed10a65fb764b1091d399323f7029e0f22b73f
AgentTesla
edcfc4bb2855541fb8aafe5cb37ffe77337c90e319548544642631f898d74bb7
AgentTesla
+ 6'271 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210701-yfvxltp8va/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
1c5e0a0d909d1da24af87967a1e154c8aa490a1f99c6624e7214d20eb84f4fec
MD5 hash:
81faf15c7e3c9446d906659f7c7a9f16
SHA1 hash:
d7e05a22b109ce608109dc509029a7fe22b4b8bf
Link:
https://www.unpac.me/results/2f245a64-614e-4a78-b905-d5a7359e9183/
SH256 hash:
1b88a5b0d723e625b68b4f19305167ef205779a3d88ded604ba4c893074583f0
MD5 hash:
d6f6525012a5e4f9e527e3b87b8a7ec8
SHA1 hash:
6fedaee5b3139ab3d26d69d0990bba5c75781803
Link:
https://www.unpac.me/results/2f245a64-614e-4a78-b905-d5a7359e9183/
SH256 hash:
6d59ff4640f41a513a8b5bcfdfa7e940a6e5e1d31dddf68702387521894f3193
MD5 hash:
27bac4e6a4deba8e44ef3e25a3feeba3
SHA1 hash:
64abbf5629a1b43110b26c432cc67db32c2e5252
Link:
https://www.unpac.me/results/2f245a64-614e-4a78-b905-d5a7359e9183/
SH256 hash:
81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87
MD5 hash:
395db038763e2172675694d317b2d7a8
SHA1 hash:
04e3fb7fab96b7711baa671a7dbb913b66d2be71
Link:
https://www.unpac.me/results/2f245a64-614e-4a78-b905-d5a7359e9183/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a00680f547b2155b2e24d09bdd49e74b38a7883a13e47553662fb657e42cf007

AgentTesla

Executable exe 81303c1d9bf6c8d28ee68ba614acb6e73183b064a70758f2cdbc168f23d52d87

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a00680f547b2155b2e24d09bdd49e74b38a7883a13e47553662fb657e42cf007
Cape
Cape
https://www.capesandbox.com/analysis/169163/

Comments