MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9
SHA3-384 hash: 329d6a6ff1b45f1aa99d0d1b054e31ee768325c78eb1bae549799d0a8c8fce8937897e024329e971d5f4fe2dba3942fa
SHA1 hash: c6ef09657bb13b34d0ed3640e190332a5ff22341
MD5 hash: 78bce13981caef5d6412f8550159b7cd
humanhash: seven-nine-sad-twelve
File name:Proforma Invoices.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:569'856 bytes
First seen:2021-04-30 19:36:26 UTC
Last seen:2021-04-30 20:01:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:SLWYiMNFMsvnRyikACuxEZPq+5kztnS+Ey7A42FPQMrX+R25EbyMqETNdYec:SLWYlNFMAn8tKxEZPzGnh2F7+RbXqEh8
Threatray 4'358 similar samples on MalwareBazaar
TLSH 3FC4D03446985FEBE3B8107DF0029100C7F582CE7551F6CE7EE8D0E59ACAB693761A29
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/147747/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.688-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/705601
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: BlueMashroom DLL Load
Sigma detected: EvilNum Golden Chickens Deployment via OCX Files
Sigma detected: Exchange Exploitation Activity
Sigma detected: Mustang Panda Dropper
Sigma detected: NotPetya Ransomware Activity
Sigma detected: QBot Process Creation
Sigma detected: Raccine Uninstall
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Sigma detected: Windows 10 Scheduled Task SandboxEscaper 0-day
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 401726 Sample: Proforma Invoices.exe Startdate: 30/04/2021 Architecture: WINDOWS Score: 100 62 Found malware configuration 2->62 64 Multi AV Scanner detection for dropped file 2->64 66 Sigma detected: Scheduled temp file as task from temp location 2->66 68 20 other signatures 2->68 7 Proforma Invoices.exe 7 2->7         started        11 newapp.exe 5 2->11         started        13 newapp.exe 2->13         started        process3 file4 44 C:\Users\user\AppData\...\aRuuJKFjAg.exe, PE32 7->44 dropped 46 C:\Users\...\aRuuJKFjAg.exe:Zone.Identifier, ASCII 7->46 dropped 48 C:\Users\user\AppData\Local\Temp\tmpF65.tmp, XML 7->48 dropped 50 C:\Users\user\...\Proforma Invoices.exe.log, ASCII 7->50 dropped 70 Injects a PE file into a foreign processes 7->70 15 Proforma Invoices.exe 2 5 7->15         started        20 schtasks.exe 1 7->20         started        72 Multi AV Scanner detection for dropped file 11->72 74 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->74 76 Machine Learning detection for dropped file 11->76 78 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->78 22 schtasks.exe 1 11->22         started        24 newapp.exe 2 11->24         started        26 schtasks.exe 13->26         started        28 newapp.exe 13->28         started        30 newapp.exe 13->30         started        32 2 other processes 13->32 signatures5 process6 dnsIp7 52 smtp.vivaldi.net 31.209.137.12, 49770, 587 HRINGDU-ASIS Iceland 15->52 40 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 15->40 dropped 42 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 15->42 dropped 54 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->54 56 Tries to steal Mail credentials (via file access) 15->56 58 Tries to harvest and steal ftp login credentials 15->58 60 2 other signatures 15->60 34 conhost.exe 20->34         started        36 conhost.exe 22->36         started        38 conhost.exe 26->38         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-04-30 19:37:06 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbiz42hweixbp42jbzser5p2bsjkz3tjcm2wmrzp6fumemuy4xmq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
014b3137818fe9c6b66f870dfb5a2d59ea9e78ef414cb28dae5142e9eeb1736c
AgentTesla
1b467c02c56a9130e3fb9e62e0ee62aa6b950845c9858f95656e659b814699c3
AgentTesla
4e8de8ccb38db94fcf3be5fb78c913f68dd86153f89976e535a8192f42fc8f59
AgentTesla
566554b534a53102dd67fc20bd07ca49241b51616d73619e383e80bdfc4fe08a
AgentTesla
5994f45fc95b80beb8ef828728bd8248455a7f2c503b025be6991a700ecbbf53
AgentTesla
7b4b43d22be88ed3b2054ef7090ebb7b44ecc03dffa6c32e578002c9a12cbea8
AgentTesla
86a499bef345b155ab8111717c6ebb408b3cbbade895b9a8fd1c700180e528e4
AgentTesla
9b49a9b7baa2dd6642fcc3c97976f6f1ddb0f8d6b4261ce4b32583c75a572e4e
AgentTesla
a1297ad5970529014466745cbb2d1615ba88de8e062e77101fab26937ac518ac
AgentTesla
f04d5b287971f60d5f04b262f3714a790b7d7c9b591ab88faa1d1f5244792d09
AgentTesla
+ 4'348 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210430-wwkz7y9p5n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
11cf5a51e593c007ff4f91294cf505ffd5e425e56387c60d81e6479cc284cc3b
MD5 hash:
73cc3f7e7700e6a54cb5f291dffe5aa1
SHA1 hash:
09174f9fa55c9bac0540efb7a8c682878a32d02d
Link:
https://www.unpac.me/results/0730ca52-72a2-427b-a608-bfc5a8a1af53/
SH256 hash:
88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9
MD5 hash:
78bce13981caef5d6412f8550159b7cd
SHA1 hash:
c6ef09657bb13b34d0ed3640e190332a5ff22341
Link:
https://www.unpac.me/results/0730ca52-72a2-427b-a608-bfc5a8a1af53/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 88519e68f6222e17f3490e6448f5fa0c92acee69133566472ff168c23298e5d9

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/147747/

Comments