MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5
SHA3-384 hash: e0b7e097aac25bf6f05383fb8db4b8774e59496f9315f2fec0f87f8da825c5df6693cf4cdd9ed33e3d6bc3adec114e45
SHA1 hash: ae07d2ec36e18775bc8c6347c73a3057d7ea7991
MD5 hash: d861e9c1a56f528517dd530d4e7f001c
humanhash: oxygen-sad-indigo-triple
File name:SC_UNMSM 06042021.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:763'904 bytes
First seen:2021-04-08 08:06:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:F8Tn2iyKwlXNJI8r9VMc0JJbDRIW/8LeXaWff1aSTZJTHkLlZem:WT2iyKWfJyceRl/fXaWXtTZFqom
Threatray 3'802 similar samples on MalwareBazaar
TLSH 50F4DF3123E8DAD5D27EA7B81471801003F8F906D632F75D6ED461A90D637A3DA7BB82
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SC_UNMSM 06042021.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 08:22:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a97ea278-d9f9-4aaa-9bcf-2ec80e2c0a52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133096/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.634-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/669745
Signature
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 383809 Sample: SC_UNMSM 06042021.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 96 31 Found malware configuration 2->31 33 Sigma detected: Scheduled temp file as task from temp location 2->33 35 Yara detected AgentTesla 2->35 37 6 other signatures 2->37 7 SC_UNMSM 06042021.exe 7 2->7         started        process3 file4 27 C:\Users\user\AppData\...\VXnpYpHihzCqu.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\Local\Temp\tmp8E5.tmp, XML 7->29 dropped 39 Adds a directory exclusion to Windows Defender 7->39 41 Injects a PE file into a foreign processes 7->41 11 powershell.exe 23 7->11         started        13 powershell.exe 24 7->13         started        15 powershell.exe 24 7->15         started        17 2 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 17:16:27 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5vmbbzetq5zwe6bo3mwce5dci6wtbvvg2vmqvz4rhgupb3q5tcq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0661d87116f44cbd5b5c6bec7fb06c4e5cd5b6ecbc5455d959e65f1ee46c54c8
AgentTesla
3683cace922eb770b74e1212f079751cffa7db8fd5f24f46ec06d710437a5652
AgentTesla
66b1c4a039bad5a8bbbd6a8d104c180906a175e28fe10a8e20b6c3ad86387320
AgentTesla
84f983067868de50e5b1553782c056c1f5b5118bb2084473ca4b6908f221cd3b
AgentTesla
89f7219c6aed63932df5feb7a41fb92f3ef7ef2885b9508a612d59644792ccb1
AgentTesla
a3ff3b7f03bfe9f9416d441fd3e94db45aac135b82b1dd90f60ad28332c83462
AgentTesla
b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884
AgentTesla
c4aab608e10b16dfd3bebdece470906af3b0595a50a5350eb7b65a6546dc1e36
AgentTesla
e41c50d817a963a03c07188bda3e42f164f1ce189f2875dc7f5125594d4ec159
AgentTesla
e600227a26ffcf8af202580592da075b8dc952783b8362889082ba110d1031e2
AgentTesla
+ 3'792 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210408-k356mlmt32/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6590b9ec4fa84e44c372fda26f47d6d58859d74869621c6bdd4086e6ae411379
MD5 hash:
95dfa1a9015a17a1d49b4faa3f3d999d
SHA1 hash:
427b72727b28436554d0443d797f19b2ea37cc16
Link:
https://www.unpac.me/results/23c626a3-0160-48fe-bb15-ba05c641c096/
SH256 hash:
9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5
MD5 hash:
d861e9c1a56f528517dd530d4e7f001c
SHA1 hash:
ae07d2ec36e18775bc8c6347c73a3057d7ea7991
Link:
https://www.unpac.me/results/23c626a3-0160-48fe-bb15-ba05c641c096/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 9f6ac087249c3b9b13c176d96113a3123d6986b536aac8573c89cd478770ecc5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/133096/

Comments