MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c
SHA3-384 hash: 3e5140813f32cb0db6c6138c070c2371e0a6ed3195b5e29e79248a604659ccb608b040f0620433028f5c19b5ca8d5f0d
SHA1 hash: f597b65986947aa9b31ca60fb4a4de90717cf6da
MD5 hash: 983ee8523fb1dcb9a063e0528a241a6a
humanhash: oregon-summer-green-massachusetts
File name:PURCHASE ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:512'512 bytes
First seen:2021-03-31 17:21:28 UTC
Last seen:2021-03-31 20:38:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:9H1HVZYKUwJBxHM3Ez1bkVJ5o8haMyXweQGaJ1R:9uwTxHM3EzNcY8hvyXwdN1R
Threatray 3'943 similar samples on MalwareBazaar
TLSH ECB4E021124CAFA1F5BC573B8895511013FAFC16CB62E62E2DF471ED59A3FE841B6A03
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PURCHASE ORDER.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-31 17:29:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c82cdec1-22f8-42e7-9ad1-b8873134926f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/129624/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.576.20621.6524.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 17:02:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ws6zt6hiixvytcljo4ymjvbljjafs4x2aecblv2dk3x2i243oroa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03f42b77429e6203cfd076d1f9a4a0a371a44ed083deba781a8914e79ae2d9b0
AgentTesla
49f7415f7b85e989eed8d42e320c82ea6f69850650672ea6d7df65332a7e48c6
AgentTesla
7c38652e82dd9a34d66d7f2086b55bd88db405974eed27dc8ac5ba3f15616729
AgentTesla
81d4a8f888a6d81d95c4bd6f0a727f335f5064b445203acf298405baf6fecc29
AgentTesla
8a3e6eba5ffc2a598f2f7d4b2c1a73c845f8c1660ed47c0cdc1df48844f7f1eb
AgentTesla
9ecab8874967c53279d62d6fece35433adf4d296ac81d255e7ea61bea88d399a
AgentTesla
a71930554d697f91b4ab6456faddbecfb15c1ebaac574db9ec735aa995dd10ac
AgentTesla
cbf9d4ef21092210f58ad0cbdd4753dbbf785387dd8f3001014672679196c65c
AgentTesla
f0d328b8d12d32d2bc29faac2f18c30b74a2e99053113fe7e9d8068408e46299
AgentTesla
f25c5db1d1c499679b705f32ac16ce11e53b7651b1133eb97418798f6ba23764
AgentTesla
+ 3'933 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210331-65kmlscb6x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d436034270fb2d5380e4fcecc1ee6c821a1701aed96045fa13f597da16be08fb
MD5 hash:
00cbf73d8b9f03417a3a32957ec64ed4
SHA1 hash:
b862eff1cf240a5ad5325fd258892e534484a6e8
Link:
https://www.unpac.me/results/b031a395-09f0-48a1-8363-65f337fa040d/
SH256 hash:
b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c
MD5 hash:
983ee8523fb1dcb9a063e0528a241a6a
SHA1 hash:
f597b65986947aa9b31ca60fb4a4de90717cf6da
Link:
https://www.unpac.me/results/b031a395-09f0-48a1-8363-65f337fa040d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 c27913bf7f31ef76592ff4c482b0aef62cac76d83fb91969b410b0ac4412dc62

AgentTesla

Executable exe b4bd99f8e845eb8989697730c4d42b4a405972fa010415d74356efa46b9b745c

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c27913bf7f31ef76592ff4c482b0aef62cac76d83fb91969b410b0ac4412dc62
Cape
Cape
https://www.capesandbox.com/analysis/129624/

Comments