MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010
SHA3-384 hash: bd10a6a40041003d6764525443fc4cd03f9d427dba2ed361c77cf8a81a418eb4829979b71c0ea603013da319a35807a2
SHA1 hash: 7ce8f5b890147cff65b19f323d290633c7d9dda6
MD5 hash: 74f6ba3e4485c883c3ad590effb12676
humanhash: ceiling-robert-tennis-angel
File name:Purchase Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'572'288 bytes
First seen:2021-03-16 11:05:26 UTC
Last seen:2021-03-17 17:42:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:zV+N28mcqWWrWWe4rEVJNawmNuWG3yUiFQeJ6VKHT5X:zV+N3mCWr6VNaKMUeQeJIKlX
Threatray 3'230 similar samples on MalwareBazaar
TLSH 7AC55EC5B628F1B0A38FDAEE6CFA4D5434C2D85DB16E51D676C8638A1801B07C2FBB15
Reporter cocaman
Tags:AgentTesla exe INVOICE

Intelligence

File Origin
# of uploads :
3
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order.exe
Verdict:
Malicious activity
Analysis date:
2021-03-16 11:08:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/316355fe-60d9-498e-911e-a6448fb52a8e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.568.17598.11719.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a recently created process
Creating a file
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f27f0401-5bbe-44d8-abb0-2a709afe0b09
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/640622
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Bypasses PowerShell execution policy
Drops PE files to the startup folder
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected Beds Obfuscator
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 369285 Sample: Purchase Order.exe Startdate: 16/03/2021 Architecture: WINDOWS Score: 100 40 api.telegram.org 2->40 44 Found malware configuration 2->44 46 Antivirus detection for dropped file 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 13 other signatures 2->50 8 Purchase Order.exe 4 2->8         started        11 Drivers.exe 4 2->11         started        signatures3 process4 file5 38 C:\Users\user\...\Purchase Order.exe.log, ASCII 8->38 dropped 13 Purchase Order.exe 15 2 8->13         started        17 powershell.exe 15 8->17         started        20 conhost.exe 8->20         started        22 powershell.exe 17 11->22         started        24 Drivers.exe 2 11->24         started        26 conhost.exe 11->26         started        28 Drivers.exe 11->28         started        process6 dnsIp7 42 api.telegram.org 149.154.167.220, 443, 49741, 49743 TELEGRAMRU United Kingdom 13->42 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->52 54 Tries to steal Mail credentials (via file access) 13->54 56 Tries to harvest and steal ftp login credentials 13->56 58 Tries to harvest and steal browser information (history, passwords, etc) 13->58 34 C:\Users\user\AppData\Roaming\...\Drivers.exe, PE32 17->34 dropped 36 C:\Users\user\...\Drivers.exe:Zone.Identifier, ASCII 17->36 dropped 60 Drops PE files to the startup folder 17->60 62 Powershell drops PE file 17->62 30 conhost.exe 17->30         started        32 conhost.exe 22->32         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 09:29:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sz5eolsfhhxte2eec2lt2ao4g5crsvnarpi67qdktjyrm4dsqaia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01cfb84c887037331adb067cbcc4ef7e34b4c9f3aa8670ddad52d32266feca37
AgentTesla
3fe64ef36bf563c4b88c055af8b943a326084b40388143459c71ab199242f7ec
AgentTesla
5e218a8b6cf31a57468b4954c81b8c43d377d9428edbe7f987dddcda3e755e47
AgentTesla
747ee0971e16540fa80072cdcc9e28a2f3fca2303303920c802219ea64c5bef2
AgentTesla
8ab6e7ca68c0c1ab0e39ede908135343fbfbfdeb3b6981f4630e6c74e73d7ca3
AgentTesla
98245891a284abcccb56bb8ccd774fbcde277259432b07294d7e3e7b864c30c1
AgentTesla
b2b6eff8a6c60704b212b98e6eb03be8bd26e1dc3bd8b6f28774bd6a52badb6d
AgentTesla
d830adad4946e743cdc39b91ce67e2c3c0ff9aedda4cf205d1756ac45bb7b2e8
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
f892fa6757d9aab17b11c24debe91cc7ecd4591bc656f9e653dacf883a1b764f
AgentTesla
+ 3'220 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210316-7ezj7pcyw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
Beds Protector Packer
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1651556571:AAEeLOHFxtsPQrSwggZb0y9M81X8caaQVew/sendDocument
Unpacked files
SH256 hash:
97024f17003dd3d31dab64c4d1b8251e50d428644eb59ed3692ad79ce42019cf
MD5 hash:
8cd28be4bd9a1404c6d3600db32b3ed1
SHA1 hash:
fb90b0ca51118e771390d58b19d0a404ee14cfbc
Link:
https://www.unpac.me/results/8d795002-4b5f-4b11-9ab6-a287c71defce/
SH256 hash:
fa51b70e2914d80c43bd64db4b39a9929f23426211ad1fbf2fc580a5e623df07
MD5 hash:
c05e2b1fdbcf51b4d24a3e74394f85c2
SHA1 hash:
111cecfcc579a616c17ca3e21d4243d0455f3118
Link:
https://www.unpac.me/results/8d795002-4b5f-4b11-9ab6-a287c71defce/
SH256 hash:
5f9393ed53ad0ac0a6492ddaeb4edcedf76558d164d7d754973f3f266ebf26eb
MD5 hash:
f11a406936eec1a93a7d6abee95bc25f
SHA1 hash:
0b3668499c53a25daacc60d2a7ee63a4d3ad5d9e
Link:
https://www.unpac.me/results/8d795002-4b5f-4b11-9ab6-a287c71defce/
SH256 hash:
967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010
MD5 hash:
74f6ba3e4485c883c3ad590effb12676
SHA1 hash:
7ce8f5b890147cff65b19f323d290633c7d9dda6
Link:
https://www.unpac.me/results/8d795002-4b5f-4b11-9ab6-a287c71defce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452

AgentTesla

Executable exe 967a472e4539ef32688416973d01dc37451955a08bd1efc06a9a711670728010

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 6591d04e5951b377a501d3b447bf8cb5a02c2660f5559dcc383556a6adca8452

Comments