MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8
SHA3-384 hash: 20350f6a236db82aefc8ea0a8c8c071b23985c61c9b5b468ced39adf269f78cc86e0547400f3ab0022fd4107271efba9
SHA1 hash: a6e4e5363591c59bd99986e71a668f6d9c4b8550
MD5 hash: 13d3d8d9c655b799acce27ab6091847b
humanhash: sixteen-zebra-yankee-red
File name:Released Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'208'832 bytes
First seen:2021-07-21 15:00:41 UTC
Last seen:2021-07-27 17:29:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:+thxEbddNXjIZfYGAYFOZcT0lCuMUipM:+tINTAfbFgcYwu
Threatray 7'140 similar samples on MalwareBazaar
TLSH T1EA459D264DCE4667C2644AB7D330EE01DEF11CAA2544EE152EC2F0EB9D3729694DED0E
dhash icon f8dcbeffbffecee8 (13 x AgentTesla, 7 x Formbook, 5 x Loki)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Released Order.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-21 15:21:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a72b042c-1dac-4329-ba0c-fecb98adef39

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/173048/
Detection(s):
SecuriteInfo.com.generic.ml.23129.14502.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/36acf2d6-fc1c-4843-9473-7f0639cd3fc4
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/819584
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-21 12:52:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
43
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wqubbtlar36zwycyyamfdaciq5gukpwwezr7rinmfiwg6irhwdea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
10e11ba4d54aa4219160cf1dc6e124bd697e91cfb85d23b170fdb74d1ac45c6e
AgentTesla
20c4c25a7ca808bcf92858f5fa653a7d50cd2f14d125bddcf8420641d95b8254
AgentTesla
3d8f71d1e009a04ceb350dc6d2d4026cde866c67aa1466957e67d5b2021f431d
AgentTesla
9613a9091f407470785d30cda2e384ae38fef3b2ad693ee00f2c65f59aada2c0
AgentTesla
b5d46013c2ad6b7eded0b3ee21406ee75c24bdac58ada6544919729ff532b07e
AgentTesla
c964743f18f47032f7b0cbfa7467b310927bb44813bd7861d4c85d55d6f34590
AgentTesla
fad59266b34827f994eba36a030a5abd4c552c3132801afec5fe74c787e10044
AgentTesla
+ 7'130 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210721-b1a7k3l98x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Contains code to disable Windows Defender
Unpacked files
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/e7f62946-bfff-48a0-ad03-2017749ac42a/
SH256 hash:
4b04ac1b993cb08a58c5b3888311113e28058b7b31cd2ac325e48544ad51dbd9
MD5 hash:
dc5b6b13d5499e7b040e22c84d6f8a2f
SHA1 hash:
e262776462aca870435f8587510173666606c86a
Link:
https://www.unpac.me/results/e7f62946-bfff-48a0-ad03-2017749ac42a/
SH256 hash:
30084ec4a45d47339164173ef32813c69ddbb8f6b7e42a6c01a4df8f1aae8561
MD5 hash:
80ac06de5be6ba7fc2ae51cdfa496553
SHA1 hash:
c8ba99e8cc2f248bcf8097640d545f8a7bcecc66
Link:
https://www.unpac.me/results/e7f62946-bfff-48a0-ad03-2017749ac42a/
SH256 hash:
b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8
MD5 hash:
13d3d8d9c655b799acce27ab6091847b
SHA1 hash:
a6e4e5363591c59bd99986e71a668f6d9c4b8550
Link:
https://www.unpac.me/results/e7f62946-bfff-48a0-ad03-2017749ac42a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e

AgentTesla

Executable exe b42810cd608efd9b6058c018518048874d453ed62663f8a1ac2a2c6f2227b0c8

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 61b763d5012aee40fea8a17077173a6fbb12ecf8339f9f3d4b5fb3e6f6bea91e
Cape
Cape
https://www.capesandbox.com/analysis/173048/

Comments