MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97
SHA3-384 hash: f9fbe13a229864f5dd16fa16ae564e96d9bfc04e5482f84a9ffbbfb591bfcf4ae3ab1c8e04cf10c7f43e4237334c4516
SHA1 hash: 1417b592570da680ee1d2a9b47af328cfc1ee8a9
MD5 hash: 235430ee1dcde985724ee7d77970b5fe
humanhash: echo-comet-pasta-angel
File name:MV. YANGTZE AMBITION V.S2101.xls.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:461'312 bytes
First seen:2021-08-23 11:10:20 UTC
Last seen:2021-08-23 11:12:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 6144:VbAXJrRLvFQSfsSs3UyBB1sSjI+ER/Ry9K178X+py/T+DUHBI6JlqdHh8BGubjpF:q5rRLB1b+LjIJR/Ayns7+Dr4DcuBbec
Threatray 8'802 similar samples on MalwareBazaar
TLSH T10DA4F141B210E497E8BB13F19C4FC71031A6AC9D91B38A0E32DAB73995F73564167B8E
dhash icon 02c4cc8a9edc0c81 (1 x AgentTesla)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
282
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
MV. YANGTZE AMBITION V.S2101.xls.exe
Verdict:
Malicious activity
Analysis date:
2021-08-23 11:11:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/677f4713-f57a-4228-89f9-6fc815965da9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/181465/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37417106.12386.1518.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c171cf4f-5e57-417c-ab75-5a393c296e67
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837461
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 469892 Sample: MV. YANGTZE AMBITION V.S210... Startdate: 23/08/2021 Architecture: WINDOWS Score: 100 27 Found malware configuration 2->27 29 Multi AV Scanner detection for dropped file 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 8 other signatures 2->33 7 MV. YANGTZE AMBITION V.S2101.xls.exe 7 2->7         started        process3 file4 21 C:\...\MV. YANGTZE AMBITION V.S2101.xls.exe, PE32 7->21 dropped 23 MV. YANGTZE AMBITI...exe:Zone.Identifier, ASCII 7->23 dropped 25 MV. YANGTZE AMBITION V.S2101.xls.exe.log, ASCII 7->25 dropped 35 Writes to foreign memory regions 7->35 37 Injects a PE file into a foreign processes 7->37 11 powershell.exe 16 7->11         started        13 powershell.exe 18 7->13         started        15 MV. YANGTZE AMBITION V.S2101.xls.exe 2 7->15         started        signatures5 process6 process7 17 conhost.exe 11->17         started        19 conhost.exe 13->19         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-16 07:18:12 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcbayreo2m5q3qjevhgtj6bskthvl2uaiswf526ktocblpgaf2lq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
061a17b2f76f71715dc416c7fa1baa215fa0b9437ebf14fa95a2a16208fc4e8d
AgentTesla
128030bd65a0160f4b879fa29b9bc70c926413ae8451a1943e8a2af08969b47a
AgentTesla
1999b409b4fdabafe9343b5a7d3f4ac0a019fe8f1f5d7ca3caf9fbe051c01ca8
AgentTesla
365f029082236e51ab346d10388e952e52ca1d99e44fa40578b3497b737a10e2
AgentTesla
48059f16b5f8c0594033ed72312c84667870344edcda6b35c0a5bc49d4839098
AgentTesla
73cefc887f0ab4d9e0269c527c1687e360493926bfb7ccc3a876b4bb19832b85
AgentTesla
a87fe4d0a4104d38592687a14002f70993af593fe3b05fe293886c8469a0ab55
AgentTesla
d6bbb80e9b3eeb6f8460547ec1bba91b9a4641a264f85d7211dcd1649c23fc85
AgentTesla
e19c08f599af43e73bb73b7183ce1b8a1e6712640d185d6f29ae0cf165bdfef5
AgentTesla
+ 8'792 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210823-tlyhgdlmkj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
849cb96052d221c73491d49a62678f9960a0fcf29e7a763c98ce9335f1a0d515
MD5 hash:
380a101853a4ec517f82ff58fa264d63
SHA1 hash:
7dcc2d16db282ebcc809b3b75fee7408589ec92e
Link:
https://www.unpac.me/results/0339b4c4-8002-482f-b32e-e96fd14bc6fb/
SH256 hash:
8c4ac129fe92fd4fb5c74d2e3cc5c3322db07f1dff26dbf6b9ff49633c7842ff
MD5 hash:
1e33f51ab608b066a00429bf0bdaa352
SHA1 hash:
422518060565eaf04a34c65b7f4f45cc3566fa98
Link:
https://www.unpac.me/results/0339b4c4-8002-482f-b32e-e96fd14bc6fb/
SH256 hash:
55f3a81c1e8e9e0160027f25dbc443b4566917b75dab8f579e6db40f81e829db
MD5 hash:
0b795e5ec86a16111bfd00903047c656
SHA1 hash:
0f49023df46bd22903815007f41107df1773e7d7
Link:
https://www.unpac.me/results/0339b4c4-8002-482f-b32e-e96fd14bc6fb/
SH256 hash:
98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97
MD5 hash:
235430ee1dcde985724ee7d77970b5fe
SHA1 hash:
1417b592570da680ee1d2a9b47af328cfc1ee8a9
Link:
https://www.unpac.me/results/0339b4c4-8002-482f-b32e-e96fd14bc6fb/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/98820c448ed3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 98820c448ed33b0dc124a9cd34f83254cf55ea8044ac5eebca9b8415bcc02e97

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/181465/

Comments