MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bac72d66599569fb9217e714c2da097b12285efe1187515dda1f89ec5b4933b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bac72d66599569fb9217e714c2da097b12285efe1187515dda1f89ec5b4933b3
SHA3-384 hash: 869e1b1ce170d2979ce3cfaf5fe6d5bff86cce7d567978f9809dddd8335275943dd8fd5ffa7f3d7bd2e2ecd5410c344a
SHA1 hash: 9781d4cf0cef375608582fa6c8fdc03cbf73fd0c
MD5 hash: 90abaf819f5ddba25065c4c6628da7a5
humanhash: item-burger-ack-delta
File name:Purchase Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:696'320 bytes
First seen:2020-12-16 14:40:13 UTC
Last seen:2020-12-16 17:10:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:82GE9SB4eHcARFQlq2yqrWxKxkt36oCCO60WFUyXyCWslmy/jT+D9:82IqG3RFQs2xNI31CaUT
Threatray 1'933 similar samples on MalwareBazaar
TLSH 59E47D343AEF6118F1B3AF764AD474A6DAAFFA733706D42E14D0138A0723A85CD91539
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order.exe
Verdict:
Malicious activity
Analysis date:
2020-12-16 14:41:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c1df4557-0a63-4b49-a5f2-19ddcc7f0693

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.jc.7429.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/564332
Signature
.NET source code contains very large array initializations
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 331252 Sample: Purchase Order.exe Startdate: 16/12/2020 Architecture: WINDOWS Score: 100 70 Multi AV Scanner detection for dropped file 2->70 72 Sigma detected: Scheduled temp file as task from temp location 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 11 other signatures 2->76 7 Purchase Order.exe 7 2->7         started        11 Mymp4.exe 4 2->11         started        13 Mymp4.exe 5 2->13         started        process3 file4 40 C:\Users\user\AppData\...\HinmbtlOFVkUvv.exe, PE32 7->40 dropped 42 C:\...\HinmbtlOFVkUvv.exe:Zone.Identifier, ASCII 7->42 dropped 44 C:\Users\user\AppData\Local\...\tmpE48C.tmp, XML 7->44 dropped 46 C:\Users\user\...\Purchase Order.exe.log, ASCII 7->46 dropped 78 Injects a PE file into a foreign processes 7->78 15 Purchase Order.exe 17 5 7->15         started        20 schtasks.exe 1 7->20         started        22 Mymp4.exe 11->22         started        24 schtasks.exe 11->24         started        80 Multi AV Scanner detection for dropped file 13->80 82 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 13->82 84 Machine Learning detection for dropped file 13->84 86 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 13->86 26 schtasks.exe 1 13->26         started        28 Mymp4.exe 2 13->28         started        signatures5 process6 dnsIp7 48 elb097307-934924932.us-east-1.elb.amazonaws.com 54.225.220.115, 443, 49750 AMAZON-AESUS United States 15->48 50 nagano-19599.herokussl.com 15->50 52 api.ipify.org 15->52 36 C:\Users\user\AppData\Roaming\...\Mymp4.exe, PE32 15->36 dropped 38 C:\Users\user\...\Mymp4.exe:Zone.Identifier, ASCII 15->38 dropped 60 Tries to steal Mail credentials (via file access) 15->60 62 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->62 64 Installs a global keyboard hook 15->64 30 conhost.exe 20->30         started        54 54.243.164.148, 443, 49752 AMAZON-AESUS United States 22->54 56 192.168.2.1 unknown unknown 22->56 58 2 other IPs or domains 22->58 66 Tries to harvest and steal ftp login credentials 22->66 68 Tries to harvest and steal browser information (history, passwords, etc) 22->68 32 conhost.exe 24->32         started        34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bac72d66599569fb9217e714c2da097b12285efe1187515dda1f89ec5b4933b3/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-16 14:39:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xlds2zszsvu7xeqx44kmfwqjpmjcqxx6cgdvcxo2d6e6yw2jgozq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
186519bfd9147fc835be7aef50ff15456e53210bbbeec69d0a0d6412999121a3
AgentTesla
3e355c206a5b82036c07832fd4e7cd823be0a5b71d272de8062c99746033387b
AgentTesla
47f2e01332f2352960848114607310d9bb23caff5a8de7d67f9e2ed7fc6944b9
AgentTesla
790b9501040e50e166ca0a8f6977348a39bcd1953b9aa708008cd8b6fc9a3b3e
AgentTesla
c21731c38a19247edee143dded4219f87e4a9bf43d5aa7d4f70d212162223448
AgentTesla
cfa9b6f6152a8e53a8e58f38bee66dc3d064aabb4641d449aed0074edd1ddd30
AgentTesla
d23fae385c1d1c2e8a92e1b47c13f113c57030d87ded1e63769cf25702f945b9
AgentTesla
d657c278508c896eb401dd575052850c94a77280113f93d60f0e2c4584877e35
AgentTesla
df27e1cee5548d6c169e700946c102ffe88442f1dcbdb7bcad449194111ca5f2
AgentTesla
eb362970c0081effbcdab7ce1f6c91d6921ff7f6e3e8e411238404f8d0549483
AgentTesla
+ 1'923 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201216-zmqf73st4x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
bac72d66599569fb9217e714c2da097b12285efe1187515dda1f89ec5b4933b3
MD5 hash:
90abaf819f5ddba25065c4c6628da7a5
SHA1 hash:
9781d4cf0cef375608582fa6c8fdc03cbf73fd0c
Link:
https://www.unpac.me/results/64523757-1fbf-46f8-b867-5e052603016c/
SH256 hash:
eac66ad61901b27b897a5cbeb99bbb9f07a0c9df6ccd2289968c3f6e07328251
MD5 hash:
139d2baca6e79bd5916721d1b16a38a8
SHA1 hash:
0f905e850e84c19dcb3d85c699aee4761f4fa390
Link:
https://www.unpac.me/results/64523757-1fbf-46f8-b867-5e052603016c/
SH256 hash:
eb362970c0081effbcdab7ce1f6c91d6921ff7f6e3e8e411238404f8d0549483
MD5 hash:
13bb24e681ae113fdb4e3747badd113c
SHA1 hash:
204e1eb03aaab856e14a8236a0c2a832ddaaf6b1
Link:
https://www.unpac.me/results/64523757-1fbf-46f8-b867-5e052603016c/
SH256 hash:
9e6ce56d8db64a84132c7b90eb623fa5f1c28c7551f57287324e880c28db5efa
MD5 hash:
0355ebede3a6459696bc1b8483640ca7
SHA1 hash:
6587534f54c9036f7096d81af2b925ff216f175b
Link:
https://www.unpac.me/results/64523757-1fbf-46f8-b867-5e052603016c/
SH256 hash:
e523faf312efb9adc39c6fce1b5fb436f21a7d515b65e514883c7ee223238dd5
MD5 hash:
f7b743397cc6310f1f1746eb5abaa6fc
SHA1 hash:
caaedfec194d53d7c96290c9d82b77936f211c14
Link:
https://www.unpac.me/results/64523757-1fbf-46f8-b867-5e052603016c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bac72d66599569fb9217e714c2da097b12285efe1187515dda1f89ec5b4933b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments