MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8639d94c28d1840858ff14f8d7cab9638d4b8c417897237089d49099c55eb94e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8639d94c28d1840858ff14f8d7cab9638d4b8c417897237089d49099c55eb94e
SHA3-384 hash: ef3c3d94fc5fc6412f8d3815ed4036695313925dd4bc425562d7e7ed8dc2b17de9483e76fd97020b95d6cf267116f912
SHA1 hash: 2d6735ece86482f2c8fe8dfd16a8ac90d859a421
MD5 hash: abddea15595d81af651b135b055196ae
humanhash: hotel-mirror-quiet-east
File name:TRANSFER.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:51'712 bytes
First seen:2022-02-01 13:42:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:Ev9u3ApxuqbjM8+SE4ad3BI0sXtFZ6R9Kn/wtBn3TTMcpetYDkDw:I9Pbuqbj1tEh3BpYtDCnjFT
Threatray 18'775 similar samples on MalwareBazaar
TLSH T1B1336D10429F68F0F5A656F9C96FB54003FACFAB8DDEE97AC8C1310BE4319D2996180D
File icon (PE):PE icon
dhash icon d4cce8b0b28ea2a2 (5 x AgentTesla, 2 x Formbook)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/229173/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Running batch commands
DNS request
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/61f938ed6d25ac9e79f5d515/reports/751c6c0e-8baf-459f-b345-ef8e488f0f14/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6162cbea-ff9e-4ed9-a132-13ebde243074
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/931678
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 564158 Sample: TRANSFER.EXE Startdate: 01/02/2022 Architecture: WINDOWS Score: 60 21 Multi AV Scanner detection for submitted file 2->21 23 .NET source code contains potential unpacker 2->23 25 Machine Learning detection for sample 2->25 27 Yara detected Costura Assembly Loader 2->27 8 TRANSFER.EXE 15 3 2->8         started        process3 dnsIp4 19 cdn.discordapp.com 162.159.130.233, 443, 49812 CLOUDFLARENETUS United States 8->19 11 powershell.exe 9 8->11         started        process5 process6 13 cmd.exe 1 11->13         started        15 conhost.exe 11->15         started        process7 17 timeout.exe 1 13->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8639d94c28d1840858ff14f8d7cab9638d4b8c417897237089d49099c55eb94e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-01 05:42:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qy45stbi2gcaqwh7ct4npsvzmoguxdcbpclsg4ej2sijtrk6xfha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a4331bb70c63296d2f975bad0903c1c9c539c1f9d349a187bfaf2633b3c06e2
AgentTesla
16a5798db6638e9ff43f3cddeeec26ee68c9294637d2c32ef8440f967dcff243
AgentTesla
1dc6e220ff2e4478bffe3973b3da34ad2859340bd964d9f607939f37cf677757
AgentTesla
4641c24b5dab522f1907c0f3b4a6649be1dd0723f13b86fab48b01f084d1ffa5
AgentTesla
78ecf7e2f54fe91840736aa4a84124f23cafee63526aacce2e86a4a644287de2
AgentTesla
e088c002556f104e0a7a4ebe6f5a154f230c6dee1d3dc3c1c44cd7515c51f37a
AgentTesla
ec575a009cea8d06ba71b882af5a53d0019f83bd4a90fb4e1b6feaa966bcd203
AgentTesla
+ 18'765 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220201-sd1kragbhl/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
8639d94c28d1840858ff14f8d7cab9638d4b8c417897237089d49099c55eb94e
MD5 hash:
abddea15595d81af651b135b055196ae
SHA1 hash:
2d6735ece86482f2c8fe8dfd16a8ac90d859a421
Link:
https://www.unpac.me/results/886e2eeb-d3b4-4e73-a72b-05d31342717d/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8639d94c28d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8639d94c28d1840858ff14f8d7cab9638d4b8c417897237089d49099c55eb94e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/229173/

Comments