MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528
SHA3-384 hash: 44e97e0b1f4d1049c1572bb9bca1caad25f5046c9d50efc39c2ea15879609f9b9a8ac7fad591225e2eaadda174d5d798
SHA1 hash: 81ed94f2fc7b7c3b822532ab34137ba9c5b8db3c
MD5 hash: d9b47d63bbad9a3d344510a226a85ba1
humanhash: november-magnesium-fix-grey
File name:REQUEST FOR QUOTATION - 20201007~PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:577'800 bytes
First seen:2020-10-07 05:07:41 UTC
Last seen:2020-10-07 06:24:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:4NccVlsA7HJbD5bGG05MwpHGjHKGWSgngIb:4NccVlsA7h5ArpHGjo
Threatray 356 similar samples on MalwareBazaar
TLSH 05C47C212F9AFC27D15B8FF0A003E614F5A5CD7A8C978A49C5BC265FC822EC47C199D9
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68788/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
Adding an access-denied ACE
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/483688
Signature
Binary contains a suspicious time stamp
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 294308 Sample: REQUEST FOR QUOTATION - 202... Startdate: 07/10/2020 Architecture: WINDOWS Score: 100 64 Multi AV Scanner detection for dropped file 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Yara detected AgentTesla 2->68 70 8 other signatures 2->70 9 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 3 4 2->9         started        13 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 2->13         started        15 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 2 2->15         started        17 2 other processes 2->17 process3 file4 60 REQUEST FOR QUOTAT...201007#U007ePDF.exe, PE32 9->60 dropped 62 REQUEST FOR QUOTAT...exe:Zone.Identifier, ASCII 9->62 dropped 76 Creates an undocumented autostart registry key 9->76 78 Hides threads from debuggers 9->78 19 WerFault.exe 23 11 9->19         started        21 timeout.exe 1 9->21         started        23 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 2 9->23         started        25 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 9->25         started        80 Creates autostart registry keys with suspicious names 13->80 82 Creates multiple autostart registry keys 13->82 27 timeout.exe 1 15->27         started        29 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 15->29         started        31 WerFault.exe 15->31         started        33 timeout.exe 1 17->33         started        35 timeout.exe 17->35         started        signatures5 process6 process7 37 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 19->37         started        40 conhost.exe 21->40         started        42 timeout.exe 27->42         started        44 conhost.exe 27->44         started        46 conhost.exe 33->46         started        48 conhost.exe 35->48         started        signatures8 72 Hides threads from debuggers 37->72 74 Injects a PE file into a foreign processes 37->74 50 timeout.exe 37->50         started        52 REQUEST FOR QUOTATION - 20201007#U007ePDF.exe 37->52         started        54 WerFault.exe 37->54         started        56 conhost.exe 42->56         started        process9 process10 58 conhost.exe 50->58         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 05:09:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2d4gjzfxbj3yc5cxpmvymevwib32bsfthl44npdcdoctogucuua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
27fc7bf4086ffad09feb291debd2bac6ca899d45dd3bc9816a3377e9324348b0
AgentTesla
476ad07360e7dc543be24793d393a093a011090ba53b5aafb21069d177271e7d
AgentTesla
516f16ca6f1b1ec44cb6c21f9849ceb0e7474adffce7530d1fe46c4483e5c27f
AgentTesla
5a6ff674194fd8f0b7221de0d402f383eec634054768bd2df0e7adc2fa825953
AgentTesla
c40de93b6a12855b8fe84ab03b11e849bf536cb3efa20bcc544b71998429bede
AgentTesla
d5e9d940acb96f85e1adb23b7ba12ef45487b995e304f3b2a5b577b4b37d52fd
AgentTesla
dd2c1275fd6239dd194f56b78c30a226552752be6197dc22358f28e7217f3ccd
AgentTesla
ea80f25ee70eca376f5e1214178f1f6d982dcb6231c79b70ad99a31fbe814b60
AgentTesla
eddfeca548fc1464fd8937442f58b868ade0a2a5b9a2780384cf622124b35c71
AgentTesla
fc97ff4201a640898a0378c099732689b17f53c54ec77b1016705e96cd8938a8
AgentTesla
+ 346 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201007-wyb31af7ca/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528
MD5 hash:
d9b47d63bbad9a3d344510a226a85ba1
SHA1 hash:
81ed94f2fc7b7c3b822532ab34137ba9c5b8db3c
Link:
https://www.unpac.me/results/6fcfbf5e-2e5c-4ae6-bb0a-91ea963115bd/
SH256 hash:
13525b4f7c67628326a7e6d38d8497a637f67c83fd0199ea3ccc87457a1edb1a
MD5 hash:
9ae01a5761927db39b0f9ab7dea54513
SHA1 hash:
bfa2bb93bec390d296cbb8a4a20da333ecf7f5b9
Link:
https://www.unpac.me/results/6fcfbf5e-2e5c-4ae6-bb0a-91ea963115bd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar abf0184fe4f6e8780eb6b692316d923b0517e559085874c8135a8aa0066cf125

AgentTesla

Executable exe 8e87c32725b853bc0ba2bbd95c3095b203bd064599d7ce35e310dc29b8d41528

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 abf0184fe4f6e8780eb6b692316d923b0517e559085874c8135a8aa0066cf125
Cape
Cape
https://www.capesandbox.com/analysis/68788/

Comments