MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 924dc4174b25a72421c29880d276e36157f4f9b9e4fab0e4148ebf86a7c3742c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 924dc4174b25a72421c29880d276e36157f4f9b9e4fab0e4148ebf86a7c3742c
SHA3-384 hash: 14bfe49bacaabdc972fd53c0395c3995ba2f9348982207e8d8714893e981d7aad0af8bb9cf2d8f74d69eb0cb878f9c1c
SHA1 hash: 1685586b191a711c1ed676398865bc70f2a98eb4
MD5 hash: e9b1bc71fc3b4475e00c83d5e45ad575
humanhash: triple-texas-oven-november
File name:Payment_Swift_ref._0000378062021_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'045'504 bytes
First seen:2021-07-13 17:54:39 UTC
Last seen:2021-07-14 12:12:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:N5N9JlPNg2zIebJAJpg35tSCxz+yMNch9vLe:d9JlFFzIUvSCxz+ifvL
Threatray 7'344 similar samples on MalwareBazaar
TLSH T11A259E6C23BDA409F337FE709FA1F7585E663EBAA625810E19C4320A6931D80ED77531
Reporter info_sec_ca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment_Swift_ref._0000378062021_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 17:56:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7c258642-e4b3-4d3c-a9db-b7a97a785f84

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171481/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.925-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a35cf69-ed28-4849-ad22-51779ff17822
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815799
Signature
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Moves itself to temp directory
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/924dc4174b25a72421c29880d276e36157f4f9b9e4fab0e4148ebf86a7c3742c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 14:11:14 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05791cd943319c72fc571ddd042d9c15545816977141d95d1ede6e4f7576c213
AgentTesla
298580b2b60cd18e7ac66ca75c0105309efc31478451ba1f338ff293af6b7e02
AgentTesla
51ca9453d5b45f1def4745ce3126dcf3e6b7d6a6b9ed39aa8a68c4c68d17ac4d
AgentTesla
542200906b6fd1d7cbf92964d984d66eb7566451cb68851ab9ddd8761fe68def
AgentTesla
8aab3eac49736133b32917dddd4c953493085e829ddc60db8603ceb7123b0443
AgentTesla
a8c94f8fc9b5c2a0cd3da68122fc36b28a7b990ace2f238961742245ece50ed5
AgentTesla
c65dd45fb74c07111e2af32a6fae4aa6c8035950f0fe2b4a162db0439f85beb1
AgentTesla
c66e48dadd79b9773eb9bf426d9f57760bad3711df997bde60ebc3895cf68147
AgentTesla
fb36eae3bb16b34bb057bbe330f5e13ed0bd8158915ec3cb9b1e694273672402
AgentTesla
+ 7'334 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-zbehnz491x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
Link:
https://www.unpac.me/results/73068272-047a-4777-ad5a-0623b6aee665/
SH256 hash:
12b5f0e3698cac5542b03f0ef8f805b5fe4d8088befcf98a83cf33ab533a10ec
MD5 hash:
84451d0fdf1462bc5aa06a05cea7d869
SHA1 hash:
ced0ec47f8dab6817fc55c699839627aff48b98d
Link:
https://www.unpac.me/results/73068272-047a-4777-ad5a-0623b6aee665/
SH256 hash:
f8f6c54704f0d9e58fa78af87f4b83afb73e36b5ba94f2d3ed192a2ea5927870
MD5 hash:
e9a8d2768163f3ac2260cb9c5dd09d6b
SHA1 hash:
2965afd89c4c9e1a5779b71ef8546894e03379e3
Link:
https://www.unpac.me/results/73068272-047a-4777-ad5a-0623b6aee665/
SH256 hash:
412698ef0c26954db4c1684aa534e2c5153ed67f1bfd38df9c17bf5dc99dc45c
MD5 hash:
1b591f5aa5151a3968f408ec3b9ed789
SHA1 hash:
29236b7f6f9f03e8781901f11ed094bece88164e
Link:
https://www.unpac.me/results/73068272-047a-4777-ad5a-0623b6aee665/
SH256 hash:
924dc4174b25a72421c29880d276e36157f4f9b9e4fab0e4148ebf86a7c3742c
MD5 hash:
e9b1bc71fc3b4475e00c83d5e45ad575
SHA1 hash:
1685586b191a711c1ed676398865bc70f2a98eb4
Link:
https://www.unpac.me/results/73068272-047a-4777-ad5a-0623b6aee665/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/924dc4174b25a72421c29880d276e36157f4f9b9e4fab0e4148ebf86a7c3742c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171481/

Comments