MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d2f04c55f015d2bf3bb2ed168aff957f4b121ca27e3ba570e7d62fd7329a202. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d2f04c55f015d2bf3bb2ed168aff957f4b121ca27e3ba570e7d62fd7329a202
SHA3-384 hash: c8607b823d99bbd26a91b05bd369aa50b8233f3406c5f581fcb281e8414ce4bb24c5a16abd37518f719e8d8814d57cd0
SHA1 hash: 8c0ed2fe3b4ffff553f4fda2d5ab4a14c569e255
MD5 hash: 4ca9bfe7e9f9cc178c45fe99d74e77f1
humanhash: football-thirteen-may-black
File name:packing list.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:49'544 bytes
First seen:2020-10-28 13:46:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:qfEjA5eCWaBDEYBcbWmPzc3lL3mfn+LUf2hm:qfEiecBDnB87olL33LUfT
TLSH 392349882D71082EE6ECED3D116F61248AF26173AE51B16B9DC8DBF7C4422CE9735D24
Reporter James_inthe_box
Tags:AgentTesla exe

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:Oct 28 06:25:28 2020 GMT
Valid to:Oct 28 06:25:28 2021 GMT
Serial number: E414655F025399CCA4D7225D89689A04
Thumbprint Algorithm:SHA256
Thumbprint: B82B3B1D1129FC0D6BAF9BF1AB86593DA313EA1490AECF2B3F617CE4E2490471
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Dtloader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80492/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Adding exclusions to Windows Defender
Enabling autorun
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/515124
Signature
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Hides threads from debuggers
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 306666 Sample: packing list.exe Startdate: 28/10/2020 Architecture: WINDOWS Score: 100 68 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->68 70 Antivirus detection for dropped file 2->70 72 Antivirus / Scanner detection for submitted sample 2->72 74 9 other signatures 2->74 7 packing list.exe 24 6 2->7         started        12 packing list.exe 2->12         started        14 packing list.exe 2->14         started        16 3 other processes 2->16 process3 dnsIp4 56 pastebin.com 104.23.99.190, 443, 49751 CLOUDFLARENETUS United States 7->56 58 ahgwqrq.xyz 104.27.181.69, 443, 49738 CLOUDFLARENETUS United States 7->58 54 C:\Users\user\AppData\...\packing list.exe, PE32 7->54 dropped 76 Creates an undocumented autostart registry key 7->76 78 Creates autostart registry keys with suspicious names 7->78 80 Creates multiple autostart registry keys 7->80 18 powershell.exe 25 7->18         started        20 powershell.exe 24 7->20         started        22 timeout.exe 1 7->22         started        30 4 other processes 7->30 60 104.23.98.190, 443, 49761 CLOUDFLARENETUS United States 12->60 62 192.168.2.1 unknown unknown 12->62 82 Adds a directory exclusion to Windows Defender 12->82 84 Hides threads from debuggers 12->84 24 timeout.exe 12->24         started        32 3 other processes 12->32 64 172.67.142.40, 443, 49752, 49756 CLOUDFLARENETUS United States 14->64 26 timeout.exe 14->26         started        66 104.27.180.69, 443, 49759, 49760 CLOUDFLARENETUS United States 16->66 28 timeout.exe 16->28         started        34 2 other processes 16->34 file5 signatures6 process7 process8 36 conhost.exe 18->36         started        38 conhost.exe 20->38         started        40 conhost.exe 22->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 2 other processes 30->48 50 2 other processes 32->50 52 2 other processes 34->52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d2f04c55f015d2bf3bb2ed168aff957f4b121ca27e3ba570e7d62fd7329a202/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 08:14:47 UTC
File Type:
PE (.Net Exe)
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ruxqjrk7afosx453f3iwrl7zk72lcioke7r3uvyopvrp24zjuiba._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201028-edaf3pg3p6/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Windows security modification
AgentTesla
Modifies WinLogon for persistence
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Turns off Windows Defender SpyNet reporting
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/80492/

Comments