MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88258a01931c3c2d513bad4d521526ee92ff155079220ec8b95bc7db54d7d4cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88258a01931c3c2d513bad4d521526ee92ff155079220ec8b95bc7db54d7d4cd
SHA3-384 hash: 1eb1005262149dc54386fdd33b1084a509371c744c82e2f170c4ee220a509912571cb7d777b14f76eae94e96069fc25b
SHA1 hash: 69446eb93a7e3efe506ca2e7cb9853b1839cff06
MD5 hash: 7342b01d6f6dd4c7d0fa2480d5b1416a
humanhash: red-angel-quebec-indigo
File name:Payment Inv1022700..exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:847'360 bytes
First seen:2021-08-09 05:31:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:IIyEMNjEfnAVin1nOKTodG97FsrfbgI1:Y9honAVin1nE8Navf1
Threatray 8'064 similar samples on MalwareBazaar
TLSH T1D505DF10A3F9179AF6FBBB389871015067F2F927AB39D64E2E5540CD8971F408AA1733
dhash icon 255a4b371b7b660f (11 x AgentTesla, 2 x AsyncRAT, 1 x RedLineStealer)
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Inv1022700..exe
Verdict:
Malicious activity
Analysis date:
2021-08-09 05:35:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fa0ed617-aa8d-4d43-9867-5d272f5a3860

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/177421/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.23608.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Moving of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a6a6d7f-03e5-4381-97d9-ed3e39e1a289
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/829010
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 461446 Sample: Payment Inv1022700..exe Startdate: 09/08/2021 Architecture: WINDOWS Score: 100 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected AgentTesla 2->51 53 8 other signatures 2->53 7 Payment Inv1022700..exe 7 2->7         started        11 EglPyOy.exe 5 2->11         started        13 EglPyOy.exe 2 2->13         started        process3 file4 29 C:\Users\user\AppData\Roaming\FsjBNLG.exe, PE32 7->29 dropped 31 C:\Users\user\AppData\Local\...\tmpFC29.tmp, XML 7->31 dropped 33 C:\Users\user\...\Payment Inv1022700..exe.log, ASCII 7->33 dropped 55 Injects a PE file into a foreign processes 7->55 15 Payment Inv1022700..exe 2 5 7->15         started        19 schtasks.exe 1 7->19         started        57 Multi AV Scanner detection for dropped file 11->57 59 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->59 61 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->61 21 schtasks.exe 1 11->21         started        23 EglPyOy.exe 2 11->23         started        signatures5 process6 file7 35 C:\Users\user\AppData\Roaming\...glPyOy.exe, PE32 15->35 dropped 37 C:\Users\user\...glPyOy.exe:Zone.Identifier, ASCII 15->37 dropped 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->39 41 Moves itself to temp directory 15->41 43 Tries to steal Mail credentials (via file access) 15->43 45 3 other signatures 15->45 25 conhost.exe 19->25         started        27 conhost.exe 21->27         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88258a01931c3c2d513bad4d521526ee92ff155079220ec8b95bc7db54d7d4cd/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-08-08 22:38:35 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rasyuamtdq6c2uj3vvgvefjg52jp6fkqpera5sfzlpd5wvgx2tgq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01c758184cc633b9d242c0ef140b307581f9a43a1699424c4aaae63adac5ec28
AgentTesla
1fee2da81b9bf7bc981a680b2e4c3c69dd683f66380a458f8bc6ac09c7156baf
AgentTesla
263b3150d2f7df08c60b0c7e677dc36e286aa987bc0852a8ebb64b96414cc809
AgentTesla
268bc95ab6377e7adf53807b9f11f41fab21e4ee82a8e6e7ed2cde84de605ff6
AgentTesla
43fef170694482498ea7cbc2f8209fc0761387df676f011cbd7c4b52b7872bb8
AgentTesla
7fc6095b91d2bb01efc48754fb7f2eb9f962b7ee06e2fa74b14609020a5ecae4
AgentTesla
94b3e37a5c039221040999418b83ab8338b165db38255ec81bc41f3a8ad2e6df
AgentTesla
a0fc7a3730fb9125bd92aa5f06e1942ae159a2030e228bc718fefac556a81a5c
AgentTesla
ec792ee233ac266c240ad4b9722b13ad8a3f3a96516511aba13254cbfdb191c4
AgentTesla
f2551f02675f06efffbc9dd02a40d7ad1e21f8d6229cf47b1725ced9887ab706
AgentTesla
+ 8'054 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210809-3xnxw57rbj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
aed00f82f1772e5a403cce9c1349202c8371e67ed9ef19a33cac0bf2a411f3c1
MD5 hash:
c273f926e2a29bd62cc8f27b569a0b2a
SHA1 hash:
e08d302cab3e11d776599a6b0537207fce6f9c51
Link:
https://www.unpac.me/results/9a84c26c-c1ec-47f5-918e-207d4987c708/
SH256 hash:
1a9516da3f21bb1e3bcebe17dacee1a7021ff41e25572af08f3326ea12f33339
MD5 hash:
d2584bdd1df9ddaab29ac8194ab02c67
SHA1 hash:
97bea11e128c15fd32d8b3051d3ee22532f8d8cd
Link:
https://www.unpac.me/results/9a84c26c-c1ec-47f5-918e-207d4987c708/
SH256 hash:
e44cd5870f0306daf6ef44a1327516d053840d49238c0a2bd27b339511fa0bfd
MD5 hash:
51a23a3016c38135ef7910dda43f0be1
SHA1 hash:
642715d377e0e73de1054ff63e0eb98101eed6c4
Link:
https://www.unpac.me/results/9a84c26c-c1ec-47f5-918e-207d4987c708/
SH256 hash:
88258a01931c3c2d513bad4d521526ee92ff155079220ec8b95bc7db54d7d4cd
MD5 hash:
7342b01d6f6dd4c7d0fa2480d5b1416a
SHA1 hash:
69446eb93a7e3efe506ca2e7cb9853b1839cff06
Link:
https://www.unpac.me/results/9a84c26c-c1ec-47f5-918e-207d4987c708/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88258a01931c3c2d513bad4d521526ee92ff155079220ec8b95bc7db54d7d4cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/177421/

Comments