MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741
SHA3-384 hash: 22f297ae68f4f0abb21b4756f9fc45d298f3547bc7fa4cc523b063de5f96604a9decba5767cfd60681e7ad2f4bb3d8a1
SHA1 hash: 5bca9d8d4e817543bb8f04b63a57d531976ea0f9
MD5 hash: cfe2db295f18a121ddfa51b924ae06c0
humanhash: wisconsin-single-fifteen-ceiling
File name:UPDATED SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:543'232 bytes
First seen:2020-12-02 06:54:36 UTC
Last seen:2020-12-02 09:04:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:T9S2lHPQddBKlTNsjwv2g8IdpcSLYokF96DfciCggt8LF:YAWKlijwJ8c5ZkF9UctH8
Threatray 10'877 similar samples on MalwareBazaar
TLSH 6AC4023257A3BE66D76F0FB4E05223440FF8B9579B10E61DFECC01D912A1B289E54AB1
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/106323/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.60651.7101.14814.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Setting a keyboard event handler
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/553238
Signature
.NET source code contains potential unpacker
Contains functionality to register a low level keyboard hook
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 325716 Sample: UPDATED SOA.exe Startdate: 02/12/2020 Architecture: WINDOWS Score: 100 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected AgentTesla 2->47 49 5 other signatures 2->49 6 UPDATED SOA.exe 3 2->6         started        10 UGxXf.exe 3 2->10         started        12 UGxXf.exe 2 2->12         started        process3 file4 23 C:\Users\user\AppData\...\UPDATED SOA.exe.log, ASCII 6->23 dropped 51 Injects a PE file into a foreign processes 6->51 14 UPDATED SOA.exe 2 5 6->14         started        53 Multi AV Scanner detection for dropped file 10->53 55 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->55 19 UGxXf.exe 2 10->19         started        21 UGxXf.exe 2 12->21         started        signatures5 process6 dnsIp7 29 mail.tpcdel.com 103.35.120.75, 49708, 49718, 49723 STPI-NOIDASoftwareTechnologyParksofIndiaBlock-IVIN India 14->29 25 C:\Users\user\AppData\Roaming\...\UGxXf.exe, PE32 14->25 dropped 27 C:\Users\user\...\UGxXf.exe:Zone.Identifier, ASCII 14->27 dropped 31 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->31 33 Installs a global keyboard hook 14->33 35 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->35 37 Tries to steal Mail credentials (via file access) 21->37 39 Tries to harvest and steal ftp login credentials 21->39 41 Tries to harvest and steal browser information (history, passwords, etc) 21->41 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-01 08:56:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3u5oxplhi46kz6qbnyfffhvhg4q6ucubl6ktlr362b24l4ne5aq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1cac7d841736846ca4d7ab5fa75c04b050c8634bf0c1eb048186a32d00b78021
AgentTesla
1fb309ceacbe3946132ea00e1bc669f3aa93fe2a05fc20afed62067c84b7f887
AgentTesla
3d90a7ed860b61af979db3c2e1ffc57615ee7a1f8e1386123d38a86c00a1572a
AgentTesla
428d4131025b3380f27194c9962cd333f871564d8cd0f46cfe1988154f487c7c
AgentTesla
63fc3b0b471168010c1f4552579de07cbdcaf074aced788680a423404996288c
AgentTesla
9e89e61ca7edd1be01262d87d8e8c512f8168f8986c1e36f3ea66a944f7018fa
AgentTesla
a178933ec1c9031e9160c346af4c6723fae57a1b208ea2d7b482b26f40d023b0
AgentTesla
a5098f19a742da9d5186552a2b5c56eb6aa8272406c8a723c613d7f7b2215afe
AgentTesla
cadf00c7c6778328b6a33baca1814637721c5650961e80f579821c4c46b359d1
AgentTesla
cb757be99c1e4b53052ab918ce223e2c4a95ffb550cbc950c6178ccdc916c05d
AgentTesla
+ 10'867 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201202-jnpyjm5rc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741
MD5 hash:
cfe2db295f18a121ddfa51b924ae06c0
SHA1 hash:
5bca9d8d4e817543bb8f04b63a57d531976ea0f9
Link:
https://www.unpac.me/results/342f515f-14bd-4ad3-a3dc-7594c8f5abd3/
SH256 hash:
07aecd6e9ba0766a6efb471bcca455e4a0c3ddfd478d9f8ccfc6aafca1b89673
MD5 hash:
014292e9eb9d5d6d72bcf628a28c10b7
SHA1 hash:
48dee045a9c863028c6c48eb1e6cd534da5bb998
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/342f515f-14bd-4ad3-a3dc-7594c8f5abd3/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/342f515f-14bd-4ad3-a3dc-7594c8f5abd3/
SH256 hash:
f587e6f79fd169ebf893f7110b925f2219b1a9e791c2a42213ec2f3b2340857d
MD5 hash:
bf08faa53da654e7fc40539126daef7f
SHA1 hash:
d34cb0934b2ce72d8104b01a7f385c986694c725
Link:
https://www.unpac.me/results/342f515f-14bd-4ad3-a3dc-7594c8f5abd3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 9c19ea5888f60b53f783f0505b91aed8b7941db56d7f74439b52413a9781ab00

AgentTesla

Executable exe 96e9d75deb3a39e567d00b705294f539b90f50540afca9ae3bf683ae2f8d2741

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9c19ea5888f60b53f783f0505b91aed8b7941db56d7f74439b52413a9781ab00
Cape
Cape
https://www.capesandbox.com/analysis/106323/

Comments