MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02
SHA3-384 hash: fc36cc80939b50858d85e950fc4f3d7bcc2b468f8b9b4f80c9b5b1993a2c447cb260cdef758f0c736fbc74cfa22904b6
SHA1 hash: d0615578d5b8db49f21e74b431271bb8a2663b42
MD5 hash: 00ec5f0cbf17f89406145e934f7ccee4
humanhash: island-vegan-green-beer
File name:kellyx_3.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:952'320 bytes
First seen:2021-05-06 12:36:13 UTC
Last seen:2021-05-06 14:09:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:HNBfR5oLLoS60/K7yh0q6J8BrP1fEUpnDeO93q/vvkTx+JAZ+TK7peLzFYLAAvUS:HNn5oLAqS8Bx8UtDeOskoJAOK7pePFY
Threatray 4'555 similar samples on MalwareBazaar
TLSH 5D1528EC751074EEC65BDC22EBCE1C25D6202176972B9607932303BD9A0ED57AF348E6
Reporter starsSk87264403
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/151588/
Detection(s):
SecuriteInfo.com.Artemis00EC5F0CBF17.2758.31775.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/714012
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 405928 Sample: kellyx_3.exe Startdate: 06/05/2021 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected AgentTesla 2->30 32 5 other signatures 2->32 6 kellyx_3.exe 3 2->6         started        10 pGKuRU.exe 3 2->10         started        12 pGKuRU.exe 2 2->12         started        process3 file4 20 C:\Users\user\AppData\...\kellyx_3.exe.log, ASCII 6->20 dropped 34 Detected unpacking (changes PE section rights) 6->34 36 Detected unpacking (overwrites its own PE header) 6->36 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->38 40 Injects a PE file into a foreign processes 6->40 14 kellyx_3.exe 2 5 6->14         started        42 Multi AV Scanner detection for dropped file 10->42 44 Machine Learning detection for dropped file 10->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->46 18 pGKuRU.exe 2 10->18         started        signatures5 process6 file7 22 C:\Users\user\AppData\Roaming\...\pGKuRU.exe, PE32 14->22 dropped 24 C:\Users\user\...\pGKuRU.exe:Zone.Identifier, ASCII 14->24 dropped 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->48 50 Tries to steal Mail credentials (via file access) 14->50 52 Tries to harvest and steal ftp login credentials 14->52 54 2 other signatures 14->54 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-06 12:37:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhrqtmtjtnxsxo4y2pepl36tdmpfpfq4dc6q6p3dgjzklnaifmba._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c35aa6b6d20fcf5548bf0c482b8201629b078fbf8a01ce58eb3d15f233a5d5c
AgentTesla
119ea5a2268265102382111254f38977bbdc06c4fb7d51f4ad21d248596bff1a
AgentTesla
13d0171a2ef946c23d3983b5b68a19de82d0882ab580014d519095f9fe31e8c1
AgentTesla
1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02
AgentTesla
3f4689ec7f18f1c30786b9953ed1fccb79f806a233aeb730fff83b432adf87bf
AgentTesla
53c1425f389198255d64a1654f9e03fc92d28ca53937f75edec2c500d9373c76
AgentTesla
5a8b5199de9f08c65f9b34eb97b375722d4c3d04e583001b6e41114b5a495770
AgentTesla
dfcc5df6ea28e158b19b5168275bd140720d5cd73e3df9dab5ecb513255d21f0
AgentTesla
e302f84b5e07423e7ed616296ee78b39ed487f43360491dc68907a3b6f0760d4
AgentTesla
f0998181a413c33d7696007625fdaa39855e454ef248ca2f2368ff2618468271
AgentTesla
+ 4'545 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210506-3s7vjljj9s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/3b7a7029-2796-4505-bbaf-cfdad330adad/
SH256 hash:
fd693ee11ad108dc15bdeb5a9a3877f016666a40b4157646449f4ec9c15cdc57
MD5 hash:
d74639b8e6aacdb8b2ef13040a611f59
SHA1 hash:
a2a55fe550f4ee76dd3716cb8bc92001ce27a93f
Link:
https://www.unpac.me/results/3b7a7029-2796-4505-bbaf-cfdad330adad/
SH256 hash:
bbe53d229d2a72875b986c463f1cf0d214a6c915f489e1d4a905ea0c13ddde63
MD5 hash:
922fd4b25edde1238e2bf871a5be96f0
SHA1 hash:
657d951fd3367a0f6927666dc10ed5d72a9c7220
Link:
https://www.unpac.me/results/3b7a7029-2796-4505-bbaf-cfdad330adad/
SH256 hash:
89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02
MD5 hash:
00ec5f0cbf17f89406145e934f7ccee4
SHA1 hash:
d0615578d5b8db49f21e74b431271bb8a2663b42
Link:
https://www.unpac.me/results/3b7a7029-2796-4505-bbaf-cfdad330adad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 89e309b2699b6f2bbb98d3c8f5efd31b1e57961c18bd0f3f633272a5b4082b02

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1179164/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/151588/

Comments