MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648
SHA3-384 hash: 2ee30eefd565e998c7793e9c08c2d1a8ef7d6b84fb019967126f9276e5af58f29e63f1659daa1350cc08ef9441170a66
SHA1 hash: 43af6a8976e5038df8fd63083c227e293c276362
MD5 hash: 11fc323f64893e6485bb743ce2f1ac07
humanhash: louisiana-idaho-one-foxtrot
File name:List Of Products Q002-O417729.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:767'488 bytes
First seen:2021-07-13 13:38:27 UTC
Last seen:2021-07-13 14:48:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:JSryz/JeImxXyeeS1R8jytf4KqHDtkM9Y3vAiEPKoyroFcafKLX3jIkr9AsgzR7x:AtyWpqtkuwvAuoET8kr
Threatray 6'659 similar samples on MalwareBazaar
TLSH T18EF4DF9C7650B5DFC81BCD768AA86C60AA206C77930BD243A15336AD9E5DAD3CF101F3
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
List Of Products Q002-O417729.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-13 13:56:16 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b3486638-328c-4714-a53b-6ec31c8b530e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171455/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.2498.19954.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77396e1f-c917-4d85-a7e8-6ffc0243e71a
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815602
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 13:39:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uv7zhflumh3ug7t2dvqi6p3fzwohvh2v7tazejyt55drpkhe4zea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
022e5da6a6272208abe79ed8ef38c7732dd091a2dcad56e845f3e833165f66eb
AgentTesla
22637e06185c1729dc491bf0d47763f8e549ae5a16223b04579240a0bbfa9f1f
AgentTesla
5dd92be22d005624d865ddf07402eb852426fc97baa52bbc58316690d41adb74
AgentTesla
65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b
AgentTesla
81a5ce1c2439d2dca4eabecfc150f3fa1003f570913157a74cf1c5c1737f006d
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
92d4922b8c19be945de3640add234d12c124bed9faf7f5a0840b9571bec5abe9
AgentTesla
bda8b57cfb54635dddd83ed0fb37e2c37450494b1692c0a4e5985024c009e814
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
e2067df39b38f67a093c4f49577cd2273180b3069e120396fddb7ec5225e6fdb
AgentTesla
+ 6'649 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-ayddr4l4fx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6b05c072e872ce14091e1d9aa75c5a833860fbca9d6c2d3202026870e9546e6c
MD5 hash:
32cd000793b72578c0607b8ba437743f
SHA1 hash:
e8add944f01649aba6393943fc2d0a4d2434b1e9
Link:
https://www.unpac.me/results/8feb4491-1819-44b3-990f-ea6e8509efa1/
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/8feb4491-1819-44b3-990f-ea6e8509efa1/
SH256 hash:
ffde73dddc669f310ca765caa800eeddf28aa5fbe878b0ce28251e46e08178eb
MD5 hash:
b201c8d4bd75ead0cae1a1d95bdb9f4e
SHA1 hash:
99d1aef63c1798baf18f1b76536c948d6779a0fe
Link:
https://www.unpac.me/results/8feb4491-1819-44b3-990f-ea6e8509efa1/
SH256 hash:
a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648
MD5 hash:
11fc323f64893e6485bb743ce2f1ac07
SHA1 hash:
43af6a8976e5038df8fd63083c227e293c276362
Link:
https://www.unpac.me/results/8feb4491-1819-44b3-990f-ea6e8509efa1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 158e28d4812a5937f2ab37e60a24a1837119e88db41ce7806c5f965e0208075e

AgentTesla

Executable exe a57f93957461f7437e7a1d608f3f65cd9c7a9f55fcc1922713ef4717a8e4e648

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 158e28d4812a5937f2ab37e60a24a1837119e88db41ce7806c5f965e0208075e
Cape
Cape
https://www.capesandbox.com/analysis/171455/

Comments