MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e
SHA3-384 hash: c3eefa6dd908fc1ab2d536286fe82bd58042aa4a99e081a39f85f8ad8a80f06a8c3a8ea38cd6a23a2d55521514709d2e
SHA1 hash: 733a8fbf58a096d534afaa9323ba7d467902895e
MD5 hash: 7eff99bbeba5535459950ae2892bb12d
humanhash: beryllium-leopard-oxygen-lake
File name:7eff99bbeba5535459950ae2892bb12d.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:59'368 bytes
First seen:2020-12-18 07:51:33 UTC
Last seen:2020-12-18 09:59:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 768:/dJJaiHuiJNppDJzkVsWjDrQ5UrmaZbgYYlpBJJKMqGflvgqMEUf2hi:/dJtDJNn1Aj+1Mb8VDKjqMEUfX
Threatray 1'906 similar samples on MalwareBazaar
TLSH 44430ED1AEF8CA5BC42EF33C16D931027FA619646A36CE5B1635356228D23845FDE80F
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.hkoffice365.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7eff99bbeba5535459950ae2892bb12d.exe
Verdict:
Malicious activity
Analysis date:
2020-12-18 07:53:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c39cca5c-c535-4a7a-a2a2-c4e48517b58f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108319/
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.106.17106.2025.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Launching a process
DNS request
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/566032
Signature
.NET source code contains very large array initializations
Connects to a pastebin service (likely for C&C)
Contains functionality to hide a thread from the debugger
Found malware configuration
Hides threads from debuggers
Injects a PE file into a foreign processes
Installs a global keyboard hook
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 332096 Sample: 8pHO7uTdXC.exe Startdate: 18/12/2020 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected AgentTesla 2->38 40 3 other signatures 2->40 7 8pHO7uTdXC.exe 15 3 2->7         started        process3 dnsIp4 26 hastebin.com 104.24.126.89, 443, 49729 CLOUDFLARENETUS United States 7->26 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->42 44 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->44 46 Hides threads from debuggers 7->46 48 2 other signatures 7->48 11 8pHO7uTdXC.exe 2 7->11         started        15 WerFault.exe 23 9 7->15         started        18 cmd.exe 1 7->18         started        signatures5 process6 dnsIp7 28 mail.hkoffice365.com 162.241.85.194, 49762, 587 OIS1US United States 11->28 30 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.220.115, 443, 49761 AMAZON-AESUS United States 11->30 32 2 other IPs or domains 11->32 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->50 52 Tries to steal Mail credentials (via file access) 11->52 54 Tries to harvest and steal ftp login credentials 11->54 56 2 other signatures 11->56 24 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 15->24 dropped 20 conhost.exe 18->20         started        22 timeout.exe 1 18->22         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e/
Threat name:
ByteCode-MSIL.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 15:54:10 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4qlwcmspdvtcex2w7ccl7gd7ft3tnhgf3g5cfaajvjeqmjqbuxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f929055fe65b564a64b56dddba8708f46ddb3e1882ca5224ce62483f86837d8
AgentTesla
119ea5a2268265102382111254f38977bbdc06c4fb7d51f4ad21d248596bff1a
AgentTesla
1b54c0c81ad125c0f59856c326b08527a95081b578b2afc0e587884b11200e3a
AgentTesla
4d798e49d6042c84dda4643b603b3642abd26d984f6530a18708e51ea624ccbb
AgentTesla
53c1425f389198255d64a1654f9e03fc92d28ca53937f75edec2c500d9373c76
AgentTesla
802d99c08b33d449595e8cc7b81971f912e6adaea2e9ccb88f56cbf03aea9319
AgentTesla
af1ce5c2a758843b6812b25d3f7646fe186575c7b06510cf8fdbcbe1f827c0c9
AgentTesla
ba3d19fdb5b0ad759b64b9871bc02d6bbd3cd8e01ce21d489f3fff9f2fab7ea9
AgentTesla
f98cf2cf8e955de4ec84861e17cb41ea86226286ffe733633e3dfda5344bae32
AgentTesla
fc60c2d2f89eed099d1b41eb4ed7912549f3e00b8fdd7d7de1ef86e67e619550
AgentTesla
+ 1'896 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201218-jr9sfapehn/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e
MD5 hash:
7eff99bbeba5535459950ae2892bb12d
SHA1 hash:
733a8fbf58a096d534afaa9323ba7d467902895e
Link:
https://www.unpac.me/results/f51be9b8-a32b-41b1-9b23-03150e3fc35e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe b720bb099278eb3112fab7c425fcc3f967b9b4e62ecdd114004d524831300d2e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/923305/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/108319/

Comments