MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376
SHA3-384 hash: d2dca0b887a835894d18b03d75ebd624e39ce87e6026508166664dd65dfb58d17d2ee82f88747417af681dda5b08a304
SHA1 hash: 4572ff4b4aafc31e1b0a11cda7e26c567bf14a0e
MD5 hash: 3d9f1e9894f0aec8947ede2716232f0c
humanhash: ten-lion-triple-kentucky
File name:Invoice 0322.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:775'680 bytes
First seen:2022-02-03 14:04:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:f9RdfJ0Mf6FV6SjZd9NkTjHd8DGYU3eDVV0JKoo:fVfJ0OUZd9NU5CuehVeo
Threatray 14'993 similar samples on MalwareBazaar
TLSH T1E5F43866A23BCE5DC90704710369B9E14EEEFEDAD5D281053BAC32CA36F97F10A45487
File icon (PE):PE icon
dhash icon 04aca2aaa2a2a280 (2 x Formbook, 1 x AgentTesla)
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/232216/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61fc310718d1bfdde4ef3140/reports/b7cdfe47-a674-4661-95cc-3713e0aea5a6/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d0c55d83-0535-4274-b3d7-3e15b1891e52
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/933675
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 14:05:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtjqlbzclsk4z7nnyhqycuwadei4b3tyjbwjeebuu3s54ewoon3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1a3c8d4c234d4766225d3b266d3287d2412c1f7a7349456490971fdd811ce5e7
AgentTesla
27063a947fb63661a2a131bba2aa322b7d3769bd0ac7a893c5c71a8593cdcd8a
AgentTesla
639ee65482f0e5653aef412d8b9f2a3c37b338f08771d99835ab5f7c66c36c0b
AgentTesla
74c2f8176fadf84bb04083901d52033b0975245676b45cd8607d80bebc91e570
AgentTesla
8c9a601f38c17856c34d8a311c6ae80c7a2038e42c554da0ae0a0555b2f5f285
AgentTesla
b045b7b993b005e1930ca50a9eb65df8b62ca29d1dfdbbb28ca6621384172908
AgentTesla
c21d2f1d2c5dad844ee2c789b2a424f0808e9eaf4edbf4319dca34531aacbe2c
AgentTesla
c4ee3e5cecf3510d88b59f4122e88f50dc99a761338dd1f8fc3eff6bfed2e005
AgentTesla
c9af30b2a800c774844eee76e019d10b72c4637adbccd34a6de3bcc8a4f32ba4
AgentTesla
+ 14'983 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220203-rdtxjaabhk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
99e97668d38e5d22b78be79a2bd64fd4ae6e3aece7c81d4cf0610c5bcb128756
MD5 hash:
f9e945367214ee0aa3c6744e504daec3
SHA1 hash:
5c5c4df4c8e725c43dd3680ab76adb2cb4e8c804
Link:
https://www.unpac.me/results/1ec3436b-ec97-47ad-8140-d842abb62541/
SH256 hash:
0640072866b7777687a7f86498a8220e37651c068454ce1215a3d943a536ada8
MD5 hash:
ebebdd1ffc53986805ef1ab08192f1f3
SHA1 hash:
fac09c531acd84b769692da2f1ad150c2fa3ab55
Link:
https://www.unpac.me/results/1ec3436b-ec97-47ad-8140-d842abb62541/
SH256 hash:
0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9
MD5 hash:
263b5190f7ac42d83c756dcdf38147bb
SHA1 hash:
78f419fe3936ed7d603706c47230cd3e6ff79ffe
Link:
https://www.unpac.me/results/1ec3436b-ec97-47ad-8140-d842abb62541/
SH256 hash:
acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376
MD5 hash:
3d9f1e9894f0aec8947ede2716232f0c
SHA1 hash:
4572ff4b4aafc31e1b0a11cda7e26c567bf14a0e
Link:
https://www.unpac.me/results/1ec3436b-ec97-47ad-8140-d842abb62541/
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/acd30587225c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acd30587225c95ccfdadc1e18152c01911c0ee78486c921034a6e5de12ce7376

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/232216/

Comments