MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852
SHA3-384 hash: dc2133805b176400b994ff9b66ddb04838a42a1cc2c7ab5f8f3c22ff5d3585a272f5522a5f7acc92925b02fc9eb690d2
SHA1 hash: 1cda546dea93153892f245e4861d1f53d8733fd1
MD5 hash: b5ad8c9499ca6655ac1235178dbaf5ab
humanhash: stairway-bluebird-robert-mars
File name:QUOTES.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:784'896 bytes
First seen:2020-12-22 12:43:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:Vf7JdszXnVcQoVPgwvUTR0QQ8x2edxBhclZx1n8NqDNup4DxS8r:NLsDVcQagwvUt0Qvx2evLSx18NqDNupN
Threatray 1'962 similar samples on MalwareBazaar
TLSH 94F4AF1BB78A4594C81476B741A8EAC63356F1CB2780C72FA69E53185E432DBBF0F24D
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: DS8420095.clientshostname.com
Sending IP: 185.159.82.34
From: sales.surratiperfumes@gmail.com
Subject: Request for Quotation
Attachment: QUOTES.zip (contains "QUOTES.exe")

AgentTesla C2:
http://69.174.99.26/webpanel-oba/inc/aaf0cc48f53372.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
QUOTES.exe
Verdict:
Malicious activity
Analysis date:
2020-12-22 13:30:17 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/4323db95-851c-41a3-be84-3c6578bebafa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/108869/
Detection(s):
SecuriteInfo.com.Variant.Bulz.273483.22025.10442.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Creating a file
Launching cmd.exe command interpreter
Creating a process from a recently created file
Launching a process
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/568370
Signature
Creates an undocumented autostart registry key
Hides that the sample has been downloaded from the Internet (zone.identifier)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333256 Sample: QUOTES.exe Startdate: 22/12/2020 Architecture: WINDOWS Score: 100 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected AgentTesla 2->51 53 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->53 9 QUOTES.exe 4 2->9         started        process3 file4 37 C:\Users\user\AppData\...\QUOTES.exe.log, ASCII 9->37 dropped 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->57 13 cmd.exe 1 9->13         started        15 cmd.exe 2 9->15         started        signatures5 process6 file7 18 QUOTE .exe 4 13->18         started        21 conhost.exe 13->21         started        41 C:\Users\user\Desktop\QUOTE .exe, PE32 15->41 dropped 23 conhost.exe 15->23         started        process8 signatures9 55 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->55 25 InstallUtil.exe 15 6 18->25         started        30 cmd.exe 1 18->30         started        process10 dnsIp11 43 69.174.99.26, 80 ASN-QUADRANET-GLOBALUS United States 25->43 39 C:\Windows\System32\drivers\etc\hosts, ASCII 25->39 dropped 59 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->59 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 25->61 63 Tries to steal Mail credentials (via file access) 25->63 65 4 other signatures 25->65 32 reg.exe 1 1 30->32         started        35 conhost.exe 30->35         started        file12 signatures13 process14 signatures15 45 Creates an undocumented autostart registry key 32->45
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 12:43:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uevvmqwunkcholn3cshqd6egno753bhzbr3epgbo6rbe3zmonbja._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
AgentTesla
14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
AgentTesla
67bff3c99f10c2b189df24202f66a3901d355847afee7de4f66c78aff794c923
AgentTesla
6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58
AgentTesla
97a573fd680ef24fba3d6d7247f05e3425696b8077f4afda2279801f6d4a57d4
AgentTesla
a148266deff592c1ba38bc1616f5483f7ba9d73f97dd88a3def54834b8434a1e
AgentTesla
be97e48f58000a3482ffd6b332e60b08a38ff72eb132fadc44d2d72de371e74f
AgentTesla
e8fc1668976751ae8b6a453020ed96065aa48636120b852363c45dfd26ec34d8
AgentTesla
f408fd39d1ec47e7ba56e85ac76e167b2cb000acde2643ec8f36c571fcc1842f
AgentTesla
fb5e770325e5d90b7de5f851ac2c14d72d18571f52d73d1bea12985e72b9c0fa
AgentTesla
+ 1'952 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201222-hsy233gb3x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops file in Drivers directory
Executes dropped EXE
Modifies WinLogon for persistence
AgentTesla
Unpacked files
SH256 hash:
a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852
MD5 hash:
b5ad8c9499ca6655ac1235178dbaf5ab
SHA1 hash:
1cda546dea93153892f245e4861d1f53d8733fd1
Link:
https://www.unpac.me/results/43750287-2fae-4909-9416-a0c3e99a99ec/
SH256 hash:
4f690f3cf792f24a571f09740cf25d0979bde8c11180a26864056643c30479cd
MD5 hash:
304cc4a1948539064cfec5b70bd83e21
SHA1 hash:
32b3754f52323fd71b8349f01c9dd4bc4fecd880
Link:
https://www.unpac.me/results/43750287-2fae-4909-9416-a0c3e99a99ec/
SH256 hash:
e00a0c88edb19681d1e68cc3218db4c987e688050c25a7c59c2c36dfe006c28a
MD5 hash:
c8563533dc1d5c06912c5417197f4780
SHA1 hash:
d19df47c2d3d468b7793126e0948c94f4e5e04aa
Link:
https://www.unpac.me/results/43750287-2fae-4909-9416-a0c3e99a99ec/
SH256 hash:
542282ed737d2cb55e3cb59d05e58e8dbf6473d63461194a9ba597f0f3eb5d75
MD5 hash:
0ab09caf48c9dcbcbd53aef80493abd2
SHA1 hash:
fd985c8ed98d443fde035be26592b92662b9c5ea
Link:
https://www.unpac.me/results/43750287-2fae-4909-9416-a0c3e99a99ec/
SH256 hash:
46d3802acb6c708fcba3fa7b0432b362a06220c078e4a16c89b248022d753e72
MD5 hash:
2706c4174f7f3794cf3428823e8e452b
SHA1 hash:
9f135a396459c2ef6b501fd6a0ad66d683da7e24
Link:
https://www.unpac.me/results/43750287-2fae-4909-9416-a0c3e99a99ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1ee14e303bd522941f0c9aacc0dada369e47533ded99c8252fec3991efb524cd

AgentTesla

Executable exe a12b5642d46a84772dbb148f01f8866bbfdd84f90c7647982ef4424de58e6852

(this sample)

  
Dropped by
MD5 c67b42f212bb75836b37bfb05965dde7
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 1ee14e303bd522941f0c9aacc0dada369e47533ded99c8252fec3991efb524cd
Cape
Cape
https://www.capesandbox.com/analysis/108869/

Comments