MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8e657e9509e8b40cd8556efe224eb446003d179b27a7f24221662ce337087bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8e657e9509e8b40cd8556efe224eb446003d179b27a7f24221662ce337087bc
SHA3-384 hash: afe43e905ce4228e41028f050a9c172e259588e7f56f15e161e5b241ad9a687ac19806494badbbaf08921b7ca44a8d2d
SHA1 hash: 54eda817f03864c805db322342cba5f47106b025
MD5 hash: 60f1ec98349e148bdbf1d3708c2495a3
humanhash: william-neptune-hamper-timing
File name:New Order-17.06.21.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:691'712 bytes
First seen:2021-06-17 14:26:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:A/Ihlm4S4F3M9yqm2iN04e09Qe+dV2p87js6U0Yy5YG0hdSAFRO8EJOfc1:A4WG1OoQeAVj7jSrhSA+9ic
Threatray 6'612 similar samples on MalwareBazaar
TLSH D6E4CF203EEAA129F177EF795AD075869ABFF7233707D84D2891038B0612E81DDD153A
Reporter Anonymous
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New Order-17.06.21.pdf.exe
Verdict:
No threats detected
Analysis date:
2021-06-17 14:29:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/897a8b7e-99a1-4795-b76b-ac6ee37d807e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166614/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/30fb968d-5117-4ec8-8fc1-724df6fb22f8
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
spre.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/803802
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 436213 Sample: New Order-17.06.21.pdf.exe Startdate: 17/06/2021 Architecture: WINDOWS Score: 100 24 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->24 26 Found malware configuration 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 8 other signatures 2->30 6 New Order-17.06.21.pdf.exe 3 2->6         started        process3 file4 18 C:\Users\...18ew Order-17.06.21.pdf.exe.log, ASCII 6->18 dropped 32 Writes to foreign memory regions 6->32 34 Allocates memory in foreign processes 6->34 36 Injects a PE file into a foreign processes 6->36 10 MSBuild.exe 2 6->10         started        14 MSBuild.exe 6->14         started        16 MSBuild.exe 6->16         started        signatures5 process6 dnsIp7 20 smtp.freislandcampina.co 10->20 22 us2.smtp.mailhostbox.com 208.91.198.143, 49693, 587 PUBLIC-DOMAIN-REGISTRYUS United States 10->22 38 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->38 40 Tries to steal Mail credentials (via file access) 10->40 42 Tries to harvest and steal ftp login credentials 10->42 44 Tries to harvest and steal browser information (history, passwords, etc) 10->44 46 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->46 48 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->48 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a8e657e9509e8b40cd8556efe224eb446003d179b27a7f24221662ce337087bc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 03:56:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdtfp2kqt2fubtmfk3x6ejhlirqahulzwj5h6jbcczrm4m3qq66a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
173256731ccf58460e223bac2eafd0f62f81b3e562fc9ee37625b9c603e3fbfa
AgentTesla
57c2349f1ebc638572ed4c2566fbae3293e1b933561d9f7dd47aac8826442eed
AgentTesla
5f063032c267a75842862b1d2bc53b4ac86fa73b1b657f5215c27e87bf04edba
AgentTesla
8c307c641b294a9cb932fe6addfd84d04ebb1a3a889f5572be5c21a01932391e
AgentTesla
96e88a52bedfff7b7270c805e1e3e3069a3d4111210a6f568d37e9a9e0ebc88d
AgentTesla
9b9ca94a89c8b711e536a215c5b56080f486148c12522d236d802a912d73410a
AgentTesla
a43e700d308ec72f30fd4098b7d4113b83c244d3679f4b59f26f7f309ebefdcc
AgentTesla
d05137187ad1369e08988ebedf21dbe0eb3b17de4dc580d933a0a3a996ce0f8d
AgentTesla
d0fb5bed25252197e74507a0660e07c788afcfd0dce03d72f6c41df5b523700e
AgentTesla
f49a6933c633b7e84dc4bbac26e3cc3f025138626362f17b98c846daf1f21895
AgentTesla
+ 6'602 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210617-lpxh31zvvx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
92ae1b933de3b46a0208ef75f65699716926fa0cea1afd74fc424b8afde249ce
MD5 hash:
0f5baeb5436502a670de5e6b88984ff3
SHA1 hash:
e3b11d344778b0de8e8e9261e519119c0872839e
Link:
https://www.unpac.me/results/abe9d9fc-f87e-48e9-8948-3ffadac4ba07/
SH256 hash:
a8e657e9509e8b40cd8556efe224eb446003d179b27a7f24221662ce337087bc
MD5 hash:
60f1ec98349e148bdbf1d3708c2495a3
SHA1 hash:
54eda817f03864c805db322342cba5f47106b025
Link:
https://www.unpac.me/results/abe9d9fc-f87e-48e9-8948-3ffadac4ba07/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8e657e9509e8b40cd8556efe224eb446003d179b27a7f24221662ce337087bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/166614/

Comments