MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a6d6dfb0f05974dc8b41f7f79a0aebcab35b5608a900e53c9726059b2afed130. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 14
| SHA256 hash: | a6d6dfb0f05974dc8b41f7f79a0aebcab35b5608a900e53c9726059b2afed130 |
|---|---|
| SHA3-384 hash: | 50402c30d39f4e8945af452400399f43b128d982a09cee28e136661b4edbda063179c3d16cf7f64e3812f6adf7a9c985 |
| SHA1 hash: | 1e71022fec8e572b1f5f95ec1f4bc2d01248d8eb |
| MD5 hash: | 3bae12842e54744bc78a10e13bbd66ca |
| humanhash: | california-lithium-single-bravo |
| File name: | SOA.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'363'456 bytes |
| First seen: | 2022-03-28 03:18:07 UTC |
| Last seen: | 2022-03-28 08:37:54 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:AppgmWPvOVP1e4YxrdAq1k1i9iBcpMEwovZV2XEV178D:/WVPgxCq1XvqEwohcUV178D |
| Threatray | 15'291 similar samples on MalwareBazaar |
| TLSH | T12255561321BCD6E4F42E3EB5C86847E806702D4A6D38E10BD98F7DCAD973683C915AD6 |
| File icon (PE): |  |
| dhash icon | 31b09c969698b033 (55 x AgentTesla, 27 x AveMariaRAT, 15 x Formbook) |
| Reporter |  GovCERT_CH |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Launching a process
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe explorer.exe findstr.exe greyware obfuscated packed replace.exe shell32.dll strictor update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-03-28 03:19:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
91
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 15'281 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
39c6742e45643f36a03ff4604c7ff482bc53fe315bf56549509e6c3d9b21fd86
MD5 hash:
f7ee283fcfa6a1c5f207cae0a3e45476
SHA1 hash:
36d934578caabfd590b3c5be5126f0798bbc486d
SH256 hash:
d7dd0f0e4e823ada46b47b588a9bd9839b250017fe7f60d664fba8e3d5c96830
MD5 hash:
f781d4e26b62d5ae146082454143a2df
SHA1 hash:
a6b90fbaf54f39b07475f7dff9e72010b00795d1
SH256 hash:
4f0146f1050d47a8907bbbe44ed92c7149bc0149a1f59d1671a9163a701c6302
MD5 hash:
5739a33a01ed4d23551d562c6daa04b6
SHA1 hash:
9df76aaabc0e193db390714daf80e808fc7a6bbe
SH256 hash:
613b2819d35360cbfe6c94b2b998d1a4998c89f5bdef505e0e158e1288ab684c
MD5 hash:
3096cbaf4b5d40f9c61bf7ce13fde62f
SHA1 hash:
6b3c580e51fd306bfdc2e727ca3bc7805aba4b53
SH256 hash:
b5b9c764a50e3109175f80004e4f473a02ed3c8cc15eaae3a873f29a27f6939c
MD5 hash:
6db7597f487c490d4d27bc98e6950e71
SHA1 hash:
53192fc59b37409290f03529206a724a54bba132
SH256 hash:
a6d6dfb0f05974dc8b41f7f79a0aebcab35b5608a900e53c9726059b2afed130
MD5 hash:
3bae12842e54744bc78a10e13bbd66ca
SHA1 hash:
1e71022fec8e572b1f5f95ec1f4bc2d01248d8eb
Malware family:
AgentTesla.v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Dropped by
agenttesla
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.