MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf923e0310c99d2ed1e447de1abfcd12ff683a41e9c1621441ede06ec759f0af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf923e0310c99d2ed1e447de1abfcd12ff683a41e9c1621441ede06ec759f0af
SHA3-384 hash: 92ed452193b3fd59299bf7e5e38df1cd027f339b99bca130a6a82936ae8a110b32cf53e525383a6dcaa4503fbcd85bd7
SHA1 hash: fc400db75d8a727bdd85698a021be876ddd2a8bf
MD5 hash: d24d7b603f03124d2e56ae4878918ac9
humanhash: lion-summer-potato-twenty
File name:74725794.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:5'911'040 bytes
First seen:2020-12-22 14:12:59 UTC
Last seen:2020-12-22 16:05:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 98304:yEKpTcr2mWNhyWbPAZdg7yzyjmkEycLBfPbaWTHFK5cAUjodSBvpxr/HdBZJEkE0:yEKVcrmhyWbLSeGycLBfPbaAlK5cAUj2
Threatray 2'012 similar samples on MalwareBazaar
TLSH F5562333A7460E64CA7672BF41D9FAE63322F1C72750471F325A46085E131DBA71FA89
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
297
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
74725794.exe
Verdict:
Malicious activity
Analysis date:
2020-12-22 14:16:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1a5e18f8-7322-4d03-b0da-06f330d188d0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/108906/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45109284.14623.9182.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/568423
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333284 Sample: 74725794.exe Startdate: 22/12/2020 Architecture: WINDOWS Score: 80 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected AgentTesla 2->33 35 Yara detected AntiVM_3 2->35 37 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->37 7 74725794.exe 5 2->7         started        process3 file4 23 C:\Users\user\AppData\...\74725794.exe.log, ASCII 7->23 dropped 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->39 11 cmd.exe 1 7->11         started        13 cmd.exe 2 7->13         started        signatures5 process6 file7 16 ghhhhjk.exe 3 11->16         started        19 conhost.exe 11->19         started        25 C:\Users\user\Favorites\...\ghhhhjk.exe, PE32 13->25 dropped 21 conhost.exe 13->21         started        process8 signatures9 27 Multi AV Scanner detection for dropped file 16->27 29 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf923e0310c99d2ed1e447de1abfcd12ff683a41e9c1621441ede06ec759f0af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 00:50:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
28 of 47 (59.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x6jd4ayqzgos5upei7pbvp6ncl7wqosb5hawefcb5xqg5r2z6cxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e770b4b1dff63afb16c1ca24f74e45905ab4e9baa1cd7ec48dada2deb252d8f
AgentTesla
1a6622548b70077312df3ffee6ffe24bcf6536f8ecf8c04bc05e54b69ba5509c
AgentTesla
385c7018cf8debb5955d9009f6c8096cecf124c975306b95c9b24bd84046e97b
AgentTesla
67f1ae4beda733f8e96c018e86be5e24f61a6cd43311a3bd23012be2ef1a71cc
AgentTesla
74cd376a930ecd532fc5677d6808325a421dec2294074d7235dc4b6db3ab1d57
AgentTesla
94e66604a68872685d623a036c3dff67af99bcd99ae88d8dc5a398470ba6cb0b
AgentTesla
ca2cea721cdeb2bcb71a5e623076d58b514de145236e8a11b39ab2863e2f975f
AgentTesla
ced74986e807f1b4dd969d4811e20b516b11b39d0d8681ebadf9123a6de30b7c
AgentTesla
de0f6d3156577dbace690119ed748be66c64e539402780878490839dd0b24234
AgentTesla
fd2a7682f371ab740d8691e13d1ab27f3919414019afd1b6ddf935394c59ba60
AgentTesla
+ 2'002 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201222-axz9a25yye/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops startup file
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
4f690f3cf792f24a571f09740cf25d0979bde8c11180a26864056643c30479cd
MD5 hash:
304cc4a1948539064cfec5b70bd83e21
SHA1 hash:
32b3754f52323fd71b8349f01c9dd4bc4fecd880
Link:
https://www.unpac.me/results/1be864f5-6139-4ea3-9a8f-0d25766f9dab/
SH256 hash:
85a08130113127dd9582106ab87f14f8a8a33fe58078b72ca4ee59edf9159dff
MD5 hash:
ced989c0c41eccef247612f1a1412e26
SHA1 hash:
f0aad0d1e4b24e5cabf369987827135d7d68b95e
Link:
https://www.unpac.me/results/1be864f5-6139-4ea3-9a8f-0d25766f9dab/
SH256 hash:
542282ed737d2cb55e3cb59d05e58e8dbf6473d63461194a9ba597f0f3eb5d75
MD5 hash:
0ab09caf48c9dcbcbd53aef80493abd2
SHA1 hash:
fd985c8ed98d443fde035be26592b92662b9c5ea
Link:
https://www.unpac.me/results/1be864f5-6139-4ea3-9a8f-0d25766f9dab/
SH256 hash:
bf923e0310c99d2ed1e447de1abfcd12ff683a41e9c1621441ede06ec759f0af
MD5 hash:
d24d7b603f03124d2e56ae4878918ac9
SHA1 hash:
fc400db75d8a727bdd85698a021be876ddd2a8bf
Link:
https://www.unpac.me/results/1be864f5-6139-4ea3-9a8f-0d25766f9dab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bf923e0310c99d2ed1e447de1abfcd12ff683a41e9c1621441ede06ec759f0af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/108906/

Comments