MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c0f0d0cc0ccc691d505577cbcf7091f1d46321d76c62a468e33c6012197257d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c0f0d0cc0ccc691d505577cbcf7091f1d46321d76c62a468e33c6012197257d
SHA3-384 hash: d49071c23e7b66fe604479639377e97e803562d0f7cc6282d9a758a2bc94cc135bb994d976c269d19049efc9fac3912d
SHA1 hash: 736f989a42e78c8e7c644f3fffeb8f216ba47e52
MD5 hash: 8b9866c443aff8a6f7f1c3ef9e7188c6
humanhash: sixteen-oranges-oscar-mountain
File name:Payment Advise.pdf..exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:650'752 bytes
First seen:2021-04-04 19:43:45 UTC
Last seen:2021-04-04 20:39:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:5uhPKXVnsJIbVe/Swsj2oMukT1jr+a3cwpKPIEKSP7r9r/+ppppppppppppppppF:oNKlLbs/Bsao5s1jroRKS1q
Threatray 3'670 similar samples on MalwareBazaar
TLSH 27D47B80E64496A0DC199BB15536CC324323BDED6833DA1C19DD3DA73BBB78E1CA5893
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Payment Advise.pdf..exe
Verdict:
Malicious activity
Analysis date:
2021-04-04 19:46:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b23a7984-543d-4843-8e7a-23d67e532b30

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132111/
Detection(s):
SecuriteInfo.com.Trojan.Hosts.48424.19133.20069.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/97601dc6-6d41-4d69-bbda-3a3906eedb56
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/665649
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 381753 Sample: Payment Advise.pdf..exe Startdate: 04/04/2021 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 8 other signatures 2->47 6 Payment Advise.pdf..exe 3 2->6         started        9 kprUEGC.exe 3 2->9         started        12 kprUEGC.exe 2 2->12         started        process3 file4 23 C:\Users\user\...\Payment Advise.pdf..exe.log, ASCII 6->23 dropped 14 Payment Advise.pdf..exe 2 5 6->14         started        49 Multi AV Scanner detection for dropped file 9->49 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 9->51 53 Machine Learning detection for dropped file 9->53 55 2 other signatures 9->55 19 kprUEGC.exe 2 9->19         started        21 kprUEGC.exe 2 12->21         started        signatures5 process6 dnsIp7 31 mail.xllentgroup.com 43.255.154.56, 49740, 587 AS-26496-GO-DADDY-COM-LLCUS Singapore 14->31 25 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 14->25 dropped 27 C:\Users\user\...\kprUEGC.exe:Zone.Identifier, ASCII 14->27 dropped 33 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->33 35 Tries to steal Mail credentials (via file access) 14->35 37 Tries to harvest and steal ftp login credentials 14->37 39 4 other signatures 14->39 29 C:\Windows\System32\drivers\etc\hosts, ASCII 21->29 dropped file8 signatures9
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-04 15:09:46 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tqhq2dgaztdjdvifk56lz5yjd4oummq5o3dcuruogpdacimxev6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
065ceb0fbdc5edcda6be175b0448361decc0f48a88dabdf39bcd31e2bbea9c29
AgentTesla
2ead443fe01ac2cd33b0b3a4bc8396fd0e067fe980e43b7e9d2327b0cb34383d
AgentTesla
46929f90e61fac74a1af7779dc41466b3ca5cb5951d64a919c2344fa057c704c
AgentTesla
6a6a7d08c8a1013d2b98c6b6f97e3401bce16a74e070262d97912f95923f82b3
AgentTesla
747ee0971e16540fa80072cdcc9e28a2f3fca2303303920c802219ea64c5bef2
AgentTesla
7efe00685831006f7656968fd2bd48f6c9af3b20331411f6976d11825052c6a6
AgentTesla
87c990c0d0a22df9778ebc4783811321835e40ea5f2d2a62f3941e5df7021b4e
AgentTesla
8aa98a082e6f19c0432ba82d1c61383c47953e5e4c5f349cb586a304f28567ca
AgentTesla
f0e5f98041b2aa53b523ff0b00e9ed45356b58406c3fbfd79fc2caa459641ecb
AgentTesla
f2b8b81f00aedfdce3806aa895884de0a003fbd4e6cc202e355630ad9fee4990
AgentTesla
+ 3'660 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210404-p4e851n9fn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
490cfa09478c8dad9cf63715023be3f604d1239fb654d46ced0aba29b8e688b2
MD5 hash:
597d89ce367f6da145f18c2637cc4756
SHA1 hash:
8dbd76c460661a802c24342bdeeb478972b08a6e
Link:
https://www.unpac.me/results/22e061b3-5227-47ad-94f6-2bff2a1465ab/
SH256 hash:
00707d997b691c28bc51bde5f419d572d8e34bbc0d5ba6dfacd213f2460f6eb6
MD5 hash:
32a4d8ce734c06fe20c3fa793eab13ad
SHA1 hash:
527326cbeb517a6ca062286a63a995bc858b17fe
Link:
https://www.unpac.me/results/22e061b3-5227-47ad-94f6-2bff2a1465ab/
SH256 hash:
814674cae06a8ef20019308d25faeaf9d7da78c00a6fe8b5adec5d7a18f0f142
MD5 hash:
a3461eb3ba9737884efaf6dd39fcf816
SHA1 hash:
29734253d3cf71cf4b89d56ab4b23abfe6b5e66c
Link:
https://www.unpac.me/results/22e061b3-5227-47ad-94f6-2bff2a1465ab/
SH256 hash:
9c0f0d0cc0ccc691d505577cbcf7091f1d46321d76c62a468e33c6012197257d
MD5 hash:
8b9866c443aff8a6f7f1c3ef9e7188c6
SHA1 hash:
736f989a42e78c8e7c644f3fffeb8f216ba47e52
Detections:
win_cannon_auto
Create hunting rule
Link:
https://www.unpac.me/results/22e061b3-5227-47ad-94f6-2bff2a1465ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c0f0d0cc0ccc691d505577cbcf7091f1d46321d76c62a468e33c6012197257d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:dridex_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_cannon_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d945e5cc8cb459395ce23dbb4c340c6b6c6a0ffd3fd296758ccc87b4ee86cc21

AgentTesla

Executable exe 9c0f0d0cc0ccc691d505577cbcf7091f1d46321d76c62a468e33c6012197257d

(this sample)

  
Dropped by
MD5 34de39b47162666fd3938ed6cdd614f5
  
Dropped by
SHA256 d945e5cc8cb459395ce23dbb4c340c6b6c6a0ffd3fd296758ccc87b4ee86cc21
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/132111/

Comments