MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9
SHA3-384 hash: 72065cf20dfa175f4973650827751c0e20b3ec175ac0de36698377b905a321a2daa879429fb2c2ec05104a57cfa99a28
SHA1 hash: eef7bac7da1d3a40f6222ddfc08962db40c0e385
MD5 hash: 70a3002b8a40775f4856fc2cc8330b84
humanhash: skylark-romeo-leopard-purple
File name:purchase order oct_20_80373592_80373595
Download: download sample
Signature AgentTesla
Create hunting rule
File size:577'536 bytes
First seen:2020-09-24 13:58:28 UTC
Last seen:2021-03-09 22:14:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ZHDOTk3cUdLMzEpwrrO+hZcNWWFXxwYOwU98:ZXs2ppB+hZcwWNxWwv
Threatray 93 similar samples on MalwareBazaar
TLSH 7DC4802D71F443B3E4B5197C09392B81931AD93A9E035F5C4B939C63A71F13C8B2AE69
Reporter malwarelabnet
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/65425/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.55082.8506.3989.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
DNS request
Sending a custom TCP request
Moving of the original file
Stealing user critical data
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/474302
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the startup folder
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
May check the online IP address of the machine
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 289595 Sample: purchase order oct_20_80373... Startdate: 24/09/2020 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Antivirus detection for dropped file 2->47 49 Antivirus / Scanner detection for submitted sample 2->49 51 8 other signatures 2->51 7 purchase order oct_20_80373592_80373595.exe 4 2->7         started        10 chrome.exe 4 2->10         started        process3 file4 31 purchase order oct...92_80373595.exe.log, ASCII 7->31 dropped 12 purchase order oct_20_80373592_80373595.exe 15 2 7->12         started        16 cmd.exe 3 7->16         started        19 chrome.exe 14 2 10->19         started        21 cmd.exe 1 10->21         started        process5 dnsIp6 33 smtp.yandex.ru 77.88.21.158, 49719, 49732, 587 YANDEXRU Russian Federation 12->33 35 elb097307-934924932.us-east-1.elb.amazonaws.com 23.21.109.69, 443, 49720 AMAZON-AESUS United States 12->35 41 3 other IPs or domains 12->41 53 Moves itself to temp directory 12->53 55 Installs a global keyboard hook 12->55 27 C:\Users\user\AppData\Roaming\...\chrome.exe, PE32 16->27 dropped 29 C:\Users\user\...\chrome.exe:Zone.Identifier, ASCII 16->29 dropped 57 Drops PE files to the startup folder 16->57 23 conhost.exe 16->23         started        37 54.225.66.103, 443, 49733 AMAZON-AESUS United States 19->37 39 smtp.yandex.com 19->39 43 2 other IPs or domains 19->43 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->59 61 Tries to steal Mail credentials (via file access) 19->61 63 Tries to harvest and steal ftp login credentials 19->63 65 Tries to harvest and steal browser information (history, passwords, etc) 19->65 25 conhost.exe 21->25         started        file7 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-24 04:48:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxe5glzbwiy5bupnad7qj2xbodvwqabu4qdz3mpw4fyhtk22ul4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b1453de5134635dc69e8359da060210c55e2af6c875497512db6332486e3ea0
AgentTesla
15ef597d7c75003efe90c9a85c5a80066671c664a1db0ea6be28c0e0f1370be3
AgentTesla
2f3474e57e4d3df1cedeef87e3716fa9143a63cf7ffdd9273273f41c8a8bc223
AgentTesla
68c67f845d8c48aa74901553deb7cc31b7f2a27954d75e4f67093c70f81eb9d6
AgentTesla
8ceba0ecd94e885f32b2e9b68373691b43887e70f6bc903878fdb74551fc919d
AgentTesla
c486e1164e6673d53529376e153bbec949ea988da1a167e5dbb9f4cd0234fdef
AgentTesla
cd2b2d05e9154852f77c8377ee83f620951e47047bb702e026690508fee44416
AgentTesla
d09186afeb1460fe7e7e33f7e319ecb280374f7c49b4240dfacc397323333834
AgentTesla
e03c4f9c8ae0b28a7538315c3af97428339911bd6118371c0459adfd14abca44
AgentTesla
f684db86a351d46abae72b79e26a108b75365f2c4819818f0e353f94326042ea
AgentTesla
+ 83 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200924-br55jfxnsa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 8dc9d32f21b231d0d1ed00ff04eae170eb680034e4079db1f6e17079ab5aa2f9

(this sample)

anyrun
any.run
https://app.any.run/tasks/d1e1e212-252f-4104-afd0-36667cd069ac
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/65425/

Comments