MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06
SHA3-384 hash: ebe9232d7e666068bc3107584800adbb9ff9a94b4d3d5539f7923aec5e9575253bf69385cc55d6f6702f48b75554fd2b
SHA1 hash: a20fd148391e6ba098285f8699ed3f9477d53262
MD5 hash: 14caf6bc3396d6da49626b7c46e5ee25
humanhash: washington-zebra-colorado-fish
File name:Purchase Order 5400851044 09.02.2021.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'576 bytes
First seen:2021-02-15 19:21:39 UTC
Last seen:2021-03-15 12:53:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:/M/t18rdf2t826OAuIfCS6rsfj4Y+VuGACKtTjC:+185NC/SE0/CE
Threatray 3'605 similar samples on MalwareBazaar
TLSH F8A4AEDC726072EFC867D472DEA82C68FA5174BB831B5203902716ED9A0D997CF244F2
Reporter malwarelabnet
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order 5400851044 09.02.2021.exe
Verdict:
Malicious activity
Analysis date:
2021-02-15 19:22:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e98a3134-b7fd-4132-a7a1-127e0589a590

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117210/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/608297
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 353179 Sample: IBDvluSj0F Startdate: 15/02/2021 Architecture: WINDOWS Score: 100 26 cdn.onenote.net 2->26 34 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->34 36 Found malware configuration 2->36 38 Multi AV Scanner detection for dropped file 2->38 40 12 other signatures 2->40 8 IBDvluSj0F.exe 6 2->8         started        signatures3 process4 file5 20 C:\Users\user\AppData\...\vWpzxTdxKyzp.exe, PE32 8->20 dropped 22 C:\Users\user\AppData\Local\...\tmp4C99.tmp, XML 8->22 dropped 24 C:\Users\user\AppData\...\IBDvluSj0F.exe.log, ASCII 8->24 dropped 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->42 44 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->44 46 Injects a PE file into a foreign processes 8->46 48 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->48 12 IBDvluSj0F.exe 15 6 8->12         started        16 schtasks.exe 1 8->16         started        signatures6 process7 dnsIp8 28 smtp.araskargopost.com 12->28 30 us2.smtp.mailhostbox.com 208.91.199.223, 49742, 49743, 587 PUBLIC-DOMAIN-REGISTRYUS United States 12->30 32 3 other IPs or domains 12->32 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->50 52 Tries to steal Mail credentials (via file access) 12->52 54 Tries to harvest and steal ftp login credentials 12->54 56 2 other signatures 12->56 18 conhost.exe 16->18         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 04:14:54 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xeclfk2etj47fzgd3tj3wxrsaeougp74hvxdxx2jvyybz4gxvqda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
113a77824329e62d8a2268075f4e8afa9756a9e134d46e87a61618d7b426b9af
AgentTesla
6b6a6cb45c75ffda98874ecb88f2fbc1ec1737222116967459117d6d8d36ecc9
AgentTesla
829b61183bd6535cd7f8ecaa211cc2ebbbef3fd8124acea0ccdd8b8572524ee2
AgentTesla
9829d39cbbfccc4142a5374e10f03470f60ea6e1f8a927b2516c8166f9b97f69
AgentTesla
b6064cc9790f02ae68fe4150b25be527352129e5d9c49f81ac320c603996ae70
AgentTesla
dc8b8addeb256bdfb0eb82d09b54b57400deed315a727e331fe66ca59c965373
AgentTesla
e788686b2a0e0efbf94e3f33a47e63494ca216e965191d82cd2922b8af6fe037
AgentTesla
e8fc1668976751ae8b6a453020ed96065aa48636120b852363c45dfd26ec34d8
AgentTesla
eda77a2a6a764257be0cc3de5d0d316cf149e28912804bda421607d6c8657f4a
AgentTesla
fb5e770325e5d90b7de5f851ac2c14d72d18571f52d73d1bea12985e72b9c0fa
AgentTesla
+ 3'595 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210215-eytdmwesvj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
0f25de07b175cefc73f0efea3d2385d237762c5385707a01436cf03b9aeb5e21
MD5 hash:
5fec8e23cc4383961e7fc8b7fd32f013
SHA1 hash:
54f24940ede705c42c597427abf0e432d98ff025
Link:
https://www.unpac.me/results/6fda1864-f715-40e3-8af3-265bfc8d1102/
SH256 hash:
ce983c0f9ecbd13b97495aaa069e24edbf4e94f67adb6245b841f92370ad88a5
MD5 hash:
5599a7f4dc27235b7f94b62f8002adaf
SHA1 hash:
c149ea7027db8cbfdeae4c891cea74348f0de431
Link:
https://www.unpac.me/results/6fda1864-f715-40e3-8af3-265bfc8d1102/
SH256 hash:
2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788
MD5 hash:
987ce346069cf47535e5ac57265c7228
SHA1 hash:
d0085325ed78fcac6d1f605753237abd1c40db22
Link:
https://www.unpac.me/results/6fda1864-f715-40e3-8af3-265bfc8d1102/
SH256 hash:
b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06
MD5 hash:
14caf6bc3396d6da49626b7c46e5ee25
SHA1 hash:
a20fd148391e6ba098285f8699ed3f9477d53262
Link:
https://www.unpac.me/results/6fda1864-f715-40e3-8af3-265bfc8d1102/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b904b2ab449a79f2e4c3dcd3bb5e32011d433ffc3d6e3bdf49ae301cf0d7ac06

(this sample)

Joe
Joe Sandbox
https://www.joesandbox.com/analysis/353179/0/html
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117210/

Comments