MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489
SHA3-384 hash: 24c3b9060d246f13186da28de6f261003c6f42cde6bc936561c44532bf9d56ba53a4c4f687c1b769349704efb5205cbe
SHA1 hash: ddab3525488ac6b92010685d64d446b2106a80ee
MD5 hash: 78b96599f396cfbf686ae87d14333509
humanhash: diet-don-venus-solar
File name:Cefla_350608317BD.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:648'192 bytes
First seen:2021-10-05 02:17:11 UTC
Last seen:2021-10-05 13:36:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:2d8CVJh4PXZrjuYU1FwC7EXFSY7yR4jwGtYJkU4z26AYEPVWWzo0x2:zC3AXZrA1FDHph
Threatray 10'710 similar samples on MalwareBazaar
TLSH T1DFD47CAC392334DEDD67C1B68DA82C70AB613CA6130B451390E37DA8B93D996DF540F6
File icon (PE):PE icon
dhash icon c088696161692b23 (4 x AgentTesla, 2 x SnakeKeylogger, 1 x CoinMiner)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
177
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Cefla_350608317BD.exe
Verdict:
Malicious activity
Analysis date:
2021-10-05 02:19:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/00faef11-0646-4f76-bce0-1db040d96d3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194808/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615c061298a6280f39324c34/reports/4deb8df7-5093-4e18-97d2-076bcad89759/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1c2c901f-f626-4155-9f18-a9436ede3545
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/864383
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 496811 Sample: Cefla_350608317BD.exe Startdate: 05/10/2021 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Yara detected AgentTesla 2->34 36 Yara detected Telegram RAT 2->36 38 6 other signatures 2->38 8 Cefla_350608317BD.exe 7 2->8         started        process3 file4 22 C:\Users\user\AppData\...\fAqBNEGQhe.exe, PE32 8->22 dropped 24 C:\Users\...\fAqBNEGQhe.exe:Zone.Identifier, ASCII 8->24 dropped 26 C:\Users\user\AppData\Local\...\tmp38D8.tmp, XML 8->26 dropped 28 C:\Users\user\...\Cefla_350608317BD.exe.log, ASCII 8->28 dropped 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->40 42 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->42 44 Uses schtasks.exe or at.exe to add and modify task schedules 8->44 46 Injects a PE file into a foreign processes 8->46 12 Cefla_350608317BD.exe 15 2 8->12         started        16 schtasks.exe 1 8->16         started        signatures5 process6 dnsIp7 30 api.telegram.org 149.154.167.220, 443, 49819 TELEGRAMRU United Kingdom 12->30 48 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->48 50 Tries to steal Mail credentials (via file access) 12->50 52 Tries to harvest and steal ftp login credentials 12->52 54 Tries to harvest and steal browser information (history, passwords, etc) 12->54 18 conhost.exe 16->18         started        signatures8 process9 process10 20 conhost.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 02:18:10 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugbrugkd67xutgwr663jxxgmwxjta7735mrgmi4b7wdpkcgeqseq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2a2bd58a0bb16a00980f69985f105a8588f3c25a4e7a1f77eed3fc740c250759
AgentTesla
4d7d74a9894de7e870220bff688bdf8a2649dc0415d0beddbc28be4b58960632
AgentTesla
92a8eaace426530cbb98518c69d0430cd7b8e8ac9d0b9f77f7d805b58d15432e
AgentTesla
98ede977d95e3ce373b2d6613e7128c138d959f94060f47b63b6d087811aba60
AgentTesla
9e01f131107841c788f990a02403dffc3d7f04b4ed0ef934c3f2ccf3c1d21d62
AgentTesla
a661b519e8e823195e7c2678943617cbdf5d19d22f9996c9e3f405d571aef736
AgentTesla
b523f00e6fe208d0e59f58e0d45740017b0659821fc7f9daae35313eb1d9e80a
AgentTesla
d8affe66153198fd44e0aeb99dadbc25c61882df8cfd6b7e4507611616581c32
AgentTesla
ea5f61ba2282bf0b98c22c548bd57a5f8115e93611d085953cd4e04f6a825615
AgentTesla
f885a70224456ed92e59c2b7f75177c2094c31f02d8b5ae8063f400c16ebdf03
AgentTesla
+ 10'700 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211005-crangshbe7/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1975237880:AAHKgRnseXCSSPJw6MgfujMF0PvBjyMOsXc/sendDocument
Unpacked files
SH256 hash:
d5595590ec7d958c16041b1ba39bdd0eef84d1b07cccc5626739eb8909a363db
MD5 hash:
da6316d68b9667aec4a0d8e25d277f60
SHA1 hash:
4836ea6c38ffa623c3489e3e0ef962eb5aaeab91
Link:
https://www.unpac.me/results/c5bbf25d-62be-4a77-82cf-e8966b02852d/
SH256 hash:
fe8637d821a39a8b74abce7e043007d38cb9c5cfcb7098af9846cfd98185ac03
MD5 hash:
c380b6831f456ac5cac08c78c0e4dada
SHA1 hash:
3e241a0b9d96c1dfbadd7ee1a8c5ee6d74eba11c
Link:
https://www.unpac.me/results/c5bbf25d-62be-4a77-82cf-e8966b02852d/
SH256 hash:
067baf6e2766a400db8ff07ca7dd0db58b685a6aa903d23b8f684d5f1d3f31e0
MD5 hash:
b7813e4f4ebe2c068dc6cf3c02d9b309
SHA1 hash:
27206e611e8a01b97bcc3ea680a0dcb03bdf3bce
Link:
https://www.unpac.me/results/c5bbf25d-62be-4a77-82cf-e8966b02852d/
SH256 hash:
a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489
MD5 hash:
78b96599f396cfbf686ae87d14333509
SHA1 hash:
ddab3525488ac6b92010685d64d446b2106a80ee
Link:
https://www.unpac.me/results/c5bbf25d-62be-4a77-82cf-e8966b02852d/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a1831a1943f7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe a1831a1943f7ef499ad1f7b69bdcccb5d3307ffbeb22662381fd86f508c48489

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/194808/

Comments