MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d5f8190ec870db510d2b95b830a07bf3c67d9996df775778dfa82b6c2bdd7b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash: 8d5f8190ec870db510d2b95b830a07bf3c67d9996df775778dfa82b6c2bdd7b3
SHA3-384 hash: dedd1a4d10081b442a4e607d530990c6d10a3beedc28e4d019fa7714563ef43bd7121b7de6beae180b54a23ab6bc3d5d
SHA1 hash: 42777245a3f79ea5b2bcf1ea48811111b1cc3529
MD5 hash: bea52e8910c076f5720ac20970e48a10
humanhash: bacon-bakerloo-march-hamper
File name:Proforma Invoice.exe
Download: download sample
Signature AgentTesla
File size:901'120 bytes
First seen:2022-07-18 08:15:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (32'074 x AgentTesla, 11'214 x Formbook, 6'134 x SnakeKeylogger)
ssdeep 12288:5UUGN9KWB4EsWm1gemIojjm9kGwW0TdepTp6eBbHsO8v+L98JxGQaEiSoQHljtGY:fWBfIFEK0ToxWOM+L213sNa
Threatray 19'734 similar samples on MalwareBazaar
TLSH T10615F12AFF25CE66C2185B36C4F70B44177446768312EF8F2BF451A82D133AB2D86AD5
TrID 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.5% (.SCR) Windows screen saver (13101/52/3)
9.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 18a219d4d4198a10 (19 x AgentTesla, 12 x Formbook, 9 x Loki)
Reporter @adrian__luca
Tags:AgentTesla exe

Intelligence


File Origin
# of uploads :
1
# of downloads :
260
Origin country :
HU HU
Mail intelligence
No data
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
behaviorgraph top1 signatures2 2 Behavior Graph ID: 668067 Sample: Proforma Invoice.exe Startdate: 18/07/2022 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Malicious sample detected (through community Yara rule) 2->37 39 Multi AV Scanner detection for dropped file 2->39 41 16 other signatures 2->41 7 Proforma Invoice.exe 12 2->7         started        process3 file4 23 C:\Users\user\AppData\...\ebJpPhiwjcAviB.exe, PE32 7->23 dropped 25 C:\...\ebJpPhiwjcAviB.exe:Zone.Identifier, ASCII 7->25 dropped 27 C:\Users\user\AppData\Local\...\tmp8D30.tmp, XML 7->27 dropped 29 C:\Users\user\...\Proforma Invoice.exe.log, ASCII 7->29 dropped 43 Adds a directory exclusion to Windows Defender 7->43 11 Proforma Invoice.exe 15 6 7->11         started        15 powershell.exe 25 7->15         started        17 schtasks.exe 1 7->17         started        signatures5 process6 dnsIp7 31 api.telegram.org 149.154.167.220, 443, 49781, 49785 TELEGRAMRU United Kingdom 11->31 33 192.168.2.1 unknown unknown 11->33 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file / registry access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 19 conhost.exe 15->19         started        21 conhost.exe 17->21         started        signatures8 process9
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-07-12 12:01:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
22 of 40 (55.00%)
Threat level:
  5/5
Result
Malware family:
agenttesla
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot5573921253:AAHXKq7lrmioCzUGP-9p7lopfbVX0A_ZdQA/sendDocument
Unpacked files
SH256 hash:
82213d097ab0cdbfc1373208f97ce53f4eb8b537b80566b7f0932077cc933b43
MD5 hash:
d9111fe90aeda4be427798ad122adcd3
SHA1 hash:
5d2c073b32c603bb0542350b86c0930361edaa9c
SH256 hash:
98dbff3834a008af02e994c03edc3419c823f182815bb07ddf302b49dafe3b56
MD5 hash:
0eacdf63c054985ec141ecc4bbaf5908
SHA1 hash:
c2b3757ca25b711e59ff5bd30a510dd3d0a4b981
SH256 hash:
dac4f6b8a4b4c1e9b0c2249a2d984b2c49d1b247994648429a7068dc387feff1
MD5 hash:
0dabb3f892998e3470d0654f1b08aa7b
SHA1 hash:
b981dde3c9b2acde74520cd00b55ca7d6b67fd60
SH256 hash:
883b63ef84c6b1cc09687962beca56e4f4b7960df7c5459e29998befaa3ccf15
MD5 hash:
ecb3f27eb8279c51608c8ea8f8050655
SHA1 hash:
82385d75444ab5fccacf37e2746c7dce73faa7f3
SH256 hash:
ea801ddd1ea57f52ae69533038861744365d8d9c05c3a9c1190dba32d07dc6b6
MD5 hash:
4d0e9bfe94004ceb16e9b63c7c03067d
SHA1 hash:
05e3fb4119f85cc6b6543d8624191a7000d856cd
SH256 hash:
8d5f8190ec870db510d2b95b830a07bf3c67d9996df775778dfa82b6c2bdd7b3
MD5 hash:
bea52e8910c076f5720ac20970e48a10
SHA1 hash:
42777245a3f79ea5b2bcf1ea48811111b1cc3529

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:pe_imphash
Rule name:Skystars_Malware_Imphash
Author:Skystars LightDefender
Description:imphash

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 8d5f8190ec870db510d2b95b830a07bf3c67d9996df775778dfa82b6c2bdd7b3

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments