MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bee8a143562146fc38a4d02e59d2f2e280dc0a547cda9983dfde0aacdea4e99e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bee8a143562146fc38a4d02e59d2f2e280dc0a547cda9983dfde0aacdea4e99e
SHA3-384 hash: e363047302dd57a6340297fdc07a80af6da483ed4a42e08fb7dc034e3795a4cc035aefb5aa77e2f45fdb214be6fc82c6
SHA1 hash: 490e150ce72289d00b9ab73f1d60766dd3e36a82
MD5 hash: 900b19cf11f6488028a0ab9460bdd26b
humanhash: lima-wolfram-sad-oxygen
File name:SecuriteInfo.com.BehavesLike.Win32.Generic.hc.12657
Download: download sample
Signature AgentTesla
Create hunting rule
File size:562'688 bytes
First seen:2020-11-13 15:54:25 UTC
Last seen:2024-07-24 21:02:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:U4ckSIZE2xIiG/txl5i6tJ7gQ0G2YvhbcZ4bfKVo0g:UFkSIHxe/vi6tJ0Q0mZgZ4i
Threatray 1'176 similar samples on MalwareBazaar
TLSH 39C423952F0C0B2BD6BD53B2F48D81C9DA74B7463857F7CA64480D9AA870FC85D842AF
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.hc.12657.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/534833
Signature
Creates multiple autostart registry keys
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 316516 Sample: SecuriteInfo.com.BehavesLik... Startdate: 14/11/2020 Architecture: WINDOWS Score: 96 36 Multi AV Scanner detection for dropped file 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected AgentTesla 2->40 42 3 other signatures 2->42 6 SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe 1 6 2->6         started        10 QXZLhnd.exe 2 2->10         started        12 vlc.exe 2 2->12         started        14 2 other processes 2->14 process3 file4 26 C:\Users\user\AppData\Roaming\...\vlc.exe, PE32 6->26 dropped 28 C:\Users\user\...\vlc.exe:Zone.Identifier, ASCII 6->28 dropped 30 SecuriteInfo.com.B....Generic.hc.exe.log, ASCII 6->30 dropped 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->46 48 Creates multiple autostart registry keys 6->48 50 Injects a PE file into a foreign processes 6->50 16 SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe 2 5 6->16         started        20 SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe 6->20         started        52 Multi AV Scanner detection for dropped file 10->52 54 Machine Learning detection for dropped file 10->54 signatures5 process6 file7 22 C:\Users\user\AppData\Roaming\...\QXZLhnd.exe, PE32 16->22 dropped 24 C:\Users\user\...\QXZLhnd.exe:Zone.Identifier, ASCII 16->24 dropped 32 Creates multiple autostart registry keys 16->32 34 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->34 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bee8a143562146fc38a4d02e59d2f2e280dc0a547cda9983dfde0aacdea4e99e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 11:58:36 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x3ukcq2wefdpyofe2axftuxs4kanycsuptnjta673yfkzxve5gpa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
AgentTesla
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
3813d5fe541f008c96f3a0f367113a1fa3c047f08815fcd8335c4b829523ca28
AgentTesla
428b4819734a979d5685b235d190ab9e07bfd6e5098e22ee9195cd386dc701d0
AgentTesla
5ccb4b42592b867c638bc0b10bd75d11865ee1bea36d8242bffe1aba403336e4
AgentTesla
723ec630211ca5a3268bd62e03caeec38b40e5d33c0e80908fec14332f006988
AgentTesla
7c2f0c42ed478e241d2fdb2580915342c5dbd50acc3fafa26908ae73a581eb3f
AgentTesla
90799ed90f14308c0bf60f347070d57b5d236cb87122ae9988145415428a391b
AgentTesla
e582696b2f3c980a6d81be401fc5da4c24a4b0c490ff6764516a0aa3e3aae23b
AgentTesla
f90cf6686fcfe69bb074cf65a5b7e19c8e97b1351377faa7a2477577d4171de8
AgentTesla
+ 1'166 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201113-pk6wme9396/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
bee8a143562146fc38a4d02e59d2f2e280dc0a547cda9983dfde0aacdea4e99e
MD5 hash:
900b19cf11f6488028a0ab9460bdd26b
SHA1 hash:
490e150ce72289d00b9ab73f1d60766dd3e36a82
Link:
https://www.unpac.me/results/372b73b3-899b-46de-8c9d-40d3ee4620ee/
SH256 hash:
7ff83fa3d1c9ad665b80a209edab84955eb61937f4448a8825bd34ae4de42204
MD5 hash:
0fffc2eeb7d04bae4521e356c057e7f2
SHA1 hash:
6b8d7fb23dbc51a1935de222f7ec258cfa20d5cf
Link:
https://www.unpac.me/results/372b73b3-899b-46de-8c9d-40d3ee4620ee/
SH256 hash:
7bb07db13d1050cbfb1983f44c2d2d61d5cd0f9c0ebea2914411e548ffb2eaa4
MD5 hash:
009fb07dd92eefd4b55c1039f73c2dd3
SHA1 hash:
9a9d6bc0d747fa367ea8600d3c1072e0ee1bacdf
Link:
https://www.unpac.me/results/372b73b3-899b-46de-8c9d-40d3ee4620ee/
SH256 hash:
83c08f0721c8b0c96e3d6a8f3ccaf5c96fbcc427d574625c34424c3429fefaa1
MD5 hash:
3c5dbcc3bb27e913e14efd8054811373
SHA1 hash:
b0eba9388abddaef9d5aa49ccd5dbab2924cced0
Link:
https://www.unpac.me/results/372b73b3-899b-46de-8c9d-40d3ee4620ee/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments