MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8
SHA3-384 hash: a9aef9b60101a668cd2929a140b7fd27d63bbad725b1666ac36e243ec269a0c5f91e01bd0ada8298effe449fc0699966
SHA1 hash: c5233c8d5a0973a76186707337a952a73c02b07e
MD5 hash: 9817218c055db1b75d64df2ae2f40f53
humanhash: magnesium-neptune-neptune-friend
File name:SecuriteInfo.com.Trojan.Siggen11.49316.15393.7982
Download: download sample
Signature AgentTesla
Create hunting rule
File size:10'985'472 bytes
First seen:2020-11-27 09:40:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 98304:f8Ysop+DEE0tLMVJfQXMjGKY+uyflLm1jFcIdxR9cy6VNsFm3rN9Yb/xy5AISV7F:f8aPMo+uOKILXE
Threatray 1'538 similar samples on MalwareBazaar
TLSH 74B696467C227453247531B88DD612F4A6CB948E2138B92A78FB5CADD21CDB73C7E272
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Spynet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/105797/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Moving of the original file
Enabling autorun by creating a file
Adding exclusions to Windows Defender
Enabling autorun
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/549132
Signature
Adds a directory exclusion to Windows Defender
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 323672 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 27/11/2020 Architecture: WINDOWS Score: 100 41 pastebin.com 2->41 45 Multi AV Scanner detection for dropped file 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected AgentTesla 2->49 51 4 other signatures 2->51 8 SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe 24 7 2->8         started        13 SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe 2->13         started        15 SecuriteInfo.com.Trojan.Siggen11.49316.15393.exe 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 43 pastebin.com 104.23.98.190, 443, 49724, 49735 CLOUDFLARENETUS United States 8->43 35 SecuriteInfo.com.T...n11.49316.15393.exe, PE32 8->35 dropped 37 SecuriteInfo.com.T...exe:Zone.Identifier, ASCII 8->37 dropped 39 SecuriteInfo.com.T...49316.15393.exe.log, ASCII 8->39 dropped 53 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->53 55 Creates an undocumented autostart registry key 8->55 57 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->57 59 5 other signatures 8->59 19 powershell.exe 16 8->19         started        21 powershell.exe 10 8->21         started        23 powershell.exe 10 8->23         started        25 2 other processes 8->25 file6 signatures7 process8 process9 27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 25->33         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8/
Threat name:
ByteCode-MSIL.Trojan.Vimditator
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 18:23:54 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xja2kutx2mmtdxwxip3ntkme2crc473mph3vhwuusojj2gkczpea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
38cf806ecaf30b5209ebce1a41e7ac877d3201cec05f4a665fe85797a7069bbc
AgentTesla
3aaaf20441f4c63cae5963d1a4244c443a32d517b95be1a26d8c77f2debca232
AgentTesla
428b4819734a979d5685b235d190ab9e07bfd6e5098e22ee9195cd386dc701d0
AgentTesla
73884bc59571b3c7199849dcdfb8330b57435a822c320d1913eb990db842fbbf
AgentTesla
9bc94d701cc45f74ee489efe7d99e84017d17a71e0232b0d14cf82c005a1ae1c
AgentTesla
b2224f39553fd82163e576e652c79f4845d238589ca4193a60a52124db08a69a
AgentTesla
b28a86d010b9e52bf00698dbef0d9daeaccc4c67ae772d83bead4541d2feed7b
AgentTesla
d3684f72802847a5b483195c93901318220f9eb288105bf725924d83d436d0f3
AgentTesla
ede0c266836e85d1ac3bc623377fda09bb0135a9746a0ecde6d7c52c7eddfc24
AgentTesla
+ 1'528 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion persistence spyware trojan
Link:
https://tria.ge/reports/201127-zx391zyhss/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Windows security modification
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Modifies WinLogon for persistence
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Turns off Windows Defender SpyNet reporting
Unpacked files
SH256 hash:
9d680d25e6d0562a540e72d7833442615ffbb8005f04548db2bc485a5315965b
MD5 hash:
941cfcad6738d7a6b22438eefffc13e5
SHA1 hash:
ca4867891e4e8827e17d37191e0fad7e1d729f6f
Link:
https://www.unpac.me/results/707cf2f3-366b-4f51-8bb7-54f42adb650b/
SH256 hash:
9146346ac0d31e0dd42ce0e3b480c4b7cbebddd8fde0541b0bea1c9dc129f680
MD5 hash:
46a18fa1ea76dabf1f546ad4fe3f5f2a
SHA1 hash:
43670d165140fbbd2c323b452f6cfdad0d2d5a5b
Link:
https://www.unpac.me/results/707cf2f3-366b-4f51-8bb7-54f42adb650b/
SH256 hash:
ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8
MD5 hash:
9817218c055db1b75d64df2ae2f40f53
SHA1 hash:
c5233c8d5a0973a76186707337a952a73c02b07e
Link:
https://www.unpac.me/results/707cf2f3-366b-4f51-8bb7-54f42adb650b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe ba41a55277d31931ded743f6d9a984d0a22e7f6c79f753da9493929d1942cbc8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/859642/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/105797/

Comments