MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c00a516a6bdcb2118625e8156904192e491dba809a8088ce8b6da29eac55d41e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	c00a516a6bdcb2118625e8156904192e491dba809a8088ce8b6da29eac55d41e
SHA3-384 hash:	25137b60a08700e09744a57244253d42c09415023de901c73a671352b81998e76f897d3edcaaaf4cacfe98da8ee65406
SHA1 hash:	5daecfea33cf020fa8adaaa3ee68038000ab09cd
MD5 hash:	6635be3dbefeeb0bbb53e66763fbeb60
humanhash:	uncle-alpha-delta-utah
File name:	QUOTATION.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	669'184 bytes
First seen:	2020-10-10 04:28:41 UTC
Last seen:	2020-10-10 05:37:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:IWKEsI3UvjZx6kxGK1nGDqPatwZE3bI5aO5WBivgO6cW:LsCWIKMOatoETO55b6c
Threatray	424 similar samples on MalwareBazaar
TLSH	45E4BE2033F91B09E1BAA7FC547561202BF63A9B222ED64E8CC314CE5978FC54D55BA3
Reporter	GovCERT_CH
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/69678/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/487377

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSBuild connects to smtp port

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c00a516a6bdcb2118625e8156904192e491dba809a8088ce8b6da29eac55d41e/

Threat name:

Win32.Trojan.Sudloader

Status:

Malicious

First seen:

2020-10-10 02:00:08 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yaffc2tl3szbdbrf5akwsbazfzer3ouatkairtulnwrj5lcv2qpa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5a6ff674194fd8f0b7221de0d402f383eec634054768bd2df0e7adc2fa825953

AgentTesla

61ec5f86a1162c5b422c27f58a27e64d15132c6f21e4499ed03b88f84fb02362

AgentTesla

aa90926f50f27f99ae4c0001883be71b64dd0bb2f818cb39481f147f52a4658e

AgentTesla

c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0

AgentTesla

d533947ea02478e71f86ece97892e0f87c0bd966395047a6e770158642134f18

AgentTesla

d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

AgentTesla

db2aa0c18078e1b88151524bd9a42092d6ad226867b128bf6b261084bc99698f

AgentTesla

dfa5e1f893c313deda7e7ea47512b756a21bba962e07cb21248b9abbdaadf3a4

AgentTesla

fb9170b75704e2202310a4ea95652f93cfcc6d4c4700055156ebb8e5532c4a9b

AgentTesla

+ 414 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201010-dnbzr6ts6s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

c00a516a6bdcb2118625e8156904192e491dba809a8088ce8b6da29eac55d41e

MD5 hash:

6635be3dbefeeb0bbb53e66763fbeb60

SHA1 hash:

5daecfea33cf020fa8adaaa3ee68038000ab09cd

Link:

https://www.unpac.me/results/d764387e-683d-4a74-bf6d-08e1856ba468/

SH256 hash:

68c259c812f1aee7ddbdb0b602b794b3b4e3b20cf794c912c2e6e43a7e7c79bc

MD5 hash:

f51ea56add36d7076079b79b230f6ae0

SHA1 hash:

4ef71266804a7699a8c61c39051fcf599ca5159c

Link:

https://www.unpac.me/results/d764387e-683d-4a74-bf6d-08e1856ba468/

SH256 hash:

3b8440c4308cc2b8d7db7d3fba00739d8109692b63382dee9be97cf2f4f7b027

MD5 hash:

e6fee54340dd2751962bf10d21b787bf

SHA1 hash:

7b95406dfc2308cb1042832db9130fdbfeda1ce4

Link:

https://www.unpac.me/results/d764387e-683d-4a74-bf6d-08e1856ba468/

SH256 hash:

607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b

MD5 hash:

a90baadadf904455325f7bc787185c7b

SHA1 hash:

7d833bb819d638008c98be469b05db2feaf201cd

Link:

https://www.unpac.me/results/d764387e-683d-4a74-bf6d-08e1856ba468/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/c00a516a6bdcb2118625e8156904192e491dba809a8088ce8b6da29eac55d41e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.