MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9f85809eedc7a4033fa134ae35c2b9ab4de23ee6b2bd923662656d531d3236e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9f85809eedc7a4033fa134ae35c2b9ab4de23ee6b2bd923662656d531d3236e
SHA3-384 hash: 48872ef7177293a65fddae2396cfa0fd079edab4a76097aec8a5902c7407417043f0a2a19bde18a4edfd44352e541dc1
SHA1 hash: 8d5f4ff019f588966efefbd38ffd0ecf3e7395e1
MD5 hash: 2332ecea4028b0e745779dd3b245eb04
humanhash: arizona-north-butter-juliet
File name:SOA PROFORMA INVOICE.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:812'544 bytes
First seen:2020-10-30 13:40:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:hmi7rCqNLhrvo2QHw99Ch5XAoc3MRh28nKAWcVZ5:si7rCqBhrvmGOXNKAW
Threatray 1'464 similar samples on MalwareBazaar
TLSH 98056C0339D9D6E9F11A373AD48A844C4BF4FA2115A1DB17ECFB31DA1A213939A13CD6
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/81242/
Detection(s):
Sanesecurity.Rogue.0hr.20201030-1511.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/517036
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9f85809eedc7a4033fa134ae35c2b9ab4de23ee6b2bd923662656d531d3236e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 12:17:49 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vh4fqcpo3r5eam72cnfogxbltk2n4i7onmv5si3gezlnkmotenxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0eca210fbcf2f5451b6106fdb10889908d7e2dc2e0eadb6ff345ed75149d17ff
AgentTesla
17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc
AgentTesla
262a211656d15bead6b81f0755443a6e8aff1a3316318b326355a575087e39d2
AgentTesla
312b49a82f8571c6c85b8322115dd46980e9005010c8e3c1d2fa27b0cb1ff0a5
AgentTesla
33f7282b31a19d0c54b18855ac47c10fa5a482a77ec94c10738744d6f9041d29
AgentTesla
4ceae1221e49d53bb92eff3f817abe974127605c00ca21d72184ee71ca0bb036
AgentTesla
8272b74901554c30f76d69d2d73685da505283e0ee95fbc21cdcd0a47560d337
AgentTesla
a02051e8bd0706ecb404bcc7df771bc035228890fc2ac09e1b2d02e686136520
AgentTesla
ecd685994c047195bf8a03b9e4a4ea800b970285806a417a9160153da37f76cb
AgentTesla
f90f1d3ed69df61ade3fda58c9a990595b88a02c066e570bff8eb8919002ee38
AgentTesla
+ 1'454 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/201030-n2jygg3yda/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 6e7b84dee189e2eb6641e56bb022d23fdbf57289350a156ca2074e9ff927c1a5

AgentTesla

Executable exe a9f85809eedc7a4033fa134ae35c2b9ab4de23ee6b2bd923662656d531d3236e

(this sample)

  
Dropped by
MD5 ee516855012240f1c9feeb36b9d6b643
  
Dropped by
SHA256 6e7b84dee189e2eb6641e56bb022d23fdbf57289350a156ca2074e9ff927c1a5
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/81242/

Comments