MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43
SHA3-384 hash: c342f38e6415a33a1f79f2a1594660b0cb40a4a1224da1c6159695460ca68157016b52f0c421b40d7a94cd675a0f691c
SHA1 hash: a9f0102af3a23aeede4f64711f2fff9150af118a
MD5 hash: 0f23db7464ee35e1ab296d7bb8b14362
humanhash: cola-wolfram-early-harry
File name:1400002766.pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'096 bytes
First seen:2021-09-24 12:12:02 UTC
Last seen:2021-09-24 13:21:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:jnSL6fGHfcK0r/w54dgFxcR4Jk2nfD1gjzySfLFndesWD+lNrAaSi1i06hsqeycf:zGEBU1xRkWfDozFRYvDsrj196qqJkyi
Threatray 10'243 similar samples on MalwareBazaar
TLSH T110A4E09197CCDE5FE3255A30A9157C1082A3D3EE24A3EA8AEC5954B13DE624CF741EC3
File icon (PE):PE icon
dhash icon 609e696169701000 (17 x AgentTesla, 5 x Formbook, 2 x SnakeKeylogger)
Reporter adrian__luca
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1400002766.pdf.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-24 12:14:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6ef34589-45b6-4bbd-b690-fbe91d292ee5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191164/
Detection(s):
SecuriteInfo.com.MachineLearning.Anomalous.100.2871.23465.UNOFFICIAL
Create hunting rule

Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d40bfa5d-28ac-41fa-89a0-02314a3f2c80
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/857341
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Yara detected AntiVM3
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 489772 Sample: 1400002766.pdf.exe Startdate: 24/09/2021 Architecture: WINDOWS Score: 100 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected AgentTesla 2->50 52 9 other signatures 2->52 8 1400002766.pdf.exe 4 2->8         started        12 kmk.exe 3 2->12         started        14 kmk.exe 2->14         started        process3 file4 36 C:\Users\user\...\1400002766.pdf.exe.log, ASCII 8->36 dropped 54 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->54 56 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->56 58 Adds a directory exclusion to Windows Defender 8->58 16 1400002766.pdf.exe 2 5 8->16         started        20 powershell.exe 24 8->20         started        22 1400002766.pdf.exe 8->22         started        24 1400002766.pdf.exe 8->24         started        60 Multi AV Scanner detection for dropped file 12->60 62 Machine Learning detection for dropped file 12->62 64 Injects a PE file into a foreign processes 12->64 26 kmk.exe 14->26         started        signatures5 process6 file7 32 C:\Users\user\AppData\Roaming\kmk\kmk.exe, PE32 16->32 dropped 34 C:\Users\user\...\kmk.exe:Zone.Identifier, ASCII 16->34 dropped 38 Tries to steal Mail credentials (via file access) 16->38 40 Tries to harvest and steal browser information (history, passwords, etc) 16->40 42 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->42 44 Installs a global keyboard hook 16->44 28 conhost.exe 20->28         started        signatures8 process9 process10 30 kmk.exe 28->30         started       
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 09:10:53 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwkflwrq2yzvwdp74afkagq5i3ggxxwmdt4ra5xiiybyg2lahzbq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0977a8fcfc104e2ab162f63f36e287f7f004f0187fb4c2a9dc0841bfbc4a0975
AgentTesla
69c28987898fe15c6a331cebce01790e6f98a28fe8184c114dde598859a07309
AgentTesla
76d2b2fe45e16137a7efe7400d8234516163ae9604cce1f10584d53f3907e9a1
AgentTesla
7f3bc638d00a6b3fd61d768fd39047fc87b97942d809d16042770d42d0e0da24
AgentTesla
c2a00bec88846bdb15410f9a61ab420963ba0a656a599991ce059adde1a381a3
AgentTesla
c810e257ac876cb505d076efee941037f5f9fd11464a4af8515d0fbac61509b1
AgentTesla
f9c716c3b4b1144cc071f6056628f3f9c7fc05f20f17697b727804826ad03d3b
AgentTesla
+ 10'233 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210924-pc9v9aghhq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1952154144:AAEHUKomldKQIyjgq_MWw4YWiGcA_iwz6T4/sendDocument
Unpacked files
SH256 hash:
74b796245fd278d7702612d341cd9d7a6a2c86d0d130fd41df3b36c91089ea5c
MD5 hash:
5d02fcf2ded2882ef3f6593b85209f00
SHA1 hash:
ee54f15652dce3374d0df26d416a5a4ec9c0dae3
Link:
https://www.unpac.me/results/7a36ea41-c227-4b11-a7f3-cfccb6278a51/
SH256 hash:
d43928dc6797951e5d5de29bd5d60ef96b6f286ae19a3af7c728ba3bfc9555f8
MD5 hash:
5b6aad46767bee7b147c436c5e1921ab
SHA1 hash:
e27c384ec15d5807f8ca120ba2d002a5666199db
Link:
https://www.unpac.me/results/7a36ea41-c227-4b11-a7f3-cfccb6278a51/
SH256 hash:
6db1f931a78333c0cbc942bd06dd70f6f83cde2e070376c7c2b89dc9b0ced39b
MD5 hash:
4ceddbee0bc4e75a1018fa77bba53944
SHA1 hash:
9b90ee18470c345c467c38a5d685af0fa51eef8b
Link:
https://www.unpac.me/results/7a36ea41-c227-4b11-a7f3-cfccb6278a51/
SH256 hash:
f44a6eb80b36ce2c85aa518c8e01313d00ed5f5d3f59371a659412b01129f367
MD5 hash:
111459714dd64ea6d784e71f1105aafc
SHA1 hash:
4e28a738b927dde4e31b840cfa41b3c86083f448
Link:
https://www.unpac.me/results/7a36ea41-c227-4b11-a7f3-cfccb6278a51/
Parent samples :
24ba16885e8cc1052640b95b43ee08c42483e1d0dadb4a10c4b87ad507d9c305
f44a6eb80b36ce2c85aa518c8e01313d00ed5f5d3f59371a659412b01129f367
a4f9e3a3944e87a7cf9eca4f206b2ed7d41361179fee32006e5bf9882f8e9855
54d629d1bbdc3dc634692b74936cabedbce47b088e07878229458b7d5acf79cd
SH256 hash:
bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43
MD5 hash:
0f23db7464ee35e1ab296d7bb8b14362
SHA1 hash:
a9f0102af3a23aeede4f64711f2fff9150af118a
Link:
https://www.unpac.me/results/7a36ea41-c227-4b11-a7f3-cfccb6278a51/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/bd9455da30d6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe bd9455da30d6335b0dffe00aa01a1d46cc6bdecc1cf91076e846038369603e43

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/191164/

Comments