MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee
SHA3-384 hash: 804f926622e51f8ad24ad30ff52400144cc9595ae2d972d0180b68c239e3808009442164ff5e4fdae655e6fbe1eee649
SHA1 hash: 515710161ed03ec60dd25568c4e6691db4ca2663
MD5 hash: be2c7a5dad0f4b7e5d888bd0e7e7e5ec
humanhash: cup-uranus-enemy-april
File name:HT210525 IV Quotation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'040 bytes
First seen:2021-06-11 09:27:27 UTC
Last seen:2021-06-11 10:53:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:5L5uAPywRh1bBYDbeShMB4Y3doIw+Sl2emGLVzSiyyjK:5L55awfdamSe1yJRl2ertd8
Threatray 5'781 similar samples on MalwareBazaar
TLSH 86E49E413298D985E0232FF618AED46053B97D5F9131C60D2E82BB9F55F3B0228A7B5F
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HT210525 IV Quotation.exe
Verdict:
Malicious activity
Analysis date:
2021-06-11 09:28:55 UTC
Tags:
keylogger stealer agenttesla
Link:
https://app.any.run/tasks/1855624c-7139-4c31-9894-9df4c027d71b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/166066/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.12484.23280.30340.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6590734f-93a7-47ef-8675-1559e172ab62
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/800743
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 433139 Sample: HT210525 IV Quotation.exe Startdate: 11/06/2021 Architecture: WINDOWS Score: 100 45 Found malware configuration 2->45 47 Multi AV Scanner detection for dropped file 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 9 other signatures 2->51 7 HT210525 IV Quotation.exe 6 2->7         started        11 NewApp.exe 2 2->11         started        13 NewApp.exe 1 2->13         started        process3 file4 27 C:\Users\user\AppData\...\jmelBaAsXW.exe, PE32 7->27 dropped 29 C:\Users\user\AppData\Local\...\tmpB3BE.tmp, XML 7->29 dropped 31 C:\Users\...\HT210525 IV Quotation.exe.log, ASCII 7->31 dropped 53 Writes to foreign memory regions 7->53 55 Injects a PE file into a foreign processes 7->55 15 RegSvcs.exe 2 4 7->15         started        19 schtasks.exe 1 7->19         started        21 conhost.exe 11->21         started        23 conhost.exe 13->23         started        signatures5 process6 file7 33 C:\Users\user\AppData\Roaming\...33ewApp.exe, PE32 15->33 dropped 35 C:\Windows\System32\drivers\etc\hosts, ASCII 15->35 dropped 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->37 39 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->39 41 Modifies the hosts file 15->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->43 25 conhost.exe 19->25         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-10 20:10:33 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykxrbfbipkgbtq2j6mkdzrsoghv77ca6d7eu4jo5phbp3ccwvtxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1d4629f9ef456b0d63a51442a9d19597baaafe09ec18ca734e9a6c8a8e818028
AgentTesla
263b3150d2f7df08c60b0c7e677dc36e286aa987bc0852a8ebb64b96414cc809
AgentTesla
268bc95ab6377e7adf53807b9f11f41fab21e4ee82a8e6e7ed2cde84de605ff6
AgentTesla
37fa514013307c5a49d68d1af2a488ad2664a0ee005594136faecfdc535f59b5
AgentTesla
486d7c96b47e6a1278f06601b3cfb146a2a453cf2b4658036f4a392298195bf9
AgentTesla
5e922ebd226625e778e389b73f24b5e0a876139697b2dcb2e93b060303b81471
AgentTesla
6024be0795c4bfa4935884cd8465d560cb37ecaa65001b8b2d76fa67e6a33c93
AgentTesla
aaf8ab71ced38032d556c579a0589e0bc57252024b8ac324048c965e8d4d5023
AgentTesla
f2551f02675f06efffbc9dd02a40d7ad1e21f8d6229cf47b1725ced9887ab706
AgentTesla
fe0fb21a7669d885fee457ce696d2a5096da1a9b4bcfe6e06b5f0d58ac4a12f2
AgentTesla
+ 5'771 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210611-y14s4rgzzx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
2e28bb39c142a419e08d13aaa29de9ffa2a5fd94936d902e6be556f022d13f80
MD5 hash:
bbc7194e9c1b99a6cc0d18ff80347d84
SHA1 hash:
fe3317677d075e5d36d4c92b3e96ac86389ee2c9
Link:
https://www.unpac.me/results/409346b3-5786-4d57-a7fb-f612e1112839/
SH256 hash:
f9a8af6167601e63949717dbc435f780ad5cdf64d9068e78c130b188e3344d59
MD5 hash:
14811c844749736a6a89ec8b8de624b1
SHA1 hash:
f6ac38a9abf0b6212dad88cce319ebbe44a9b84b
Link:
https://www.unpac.me/results/409346b3-5786-4d57-a7fb-f612e1112839/
SH256 hash:
5bede9eedf6ae6df5a9d587c116c9583b31474c159c2b53486b000093cb3fde6
MD5 hash:
072eeac61b35d3f09edee4ff4f80f52d
SHA1 hash:
696fd9905a47e526470c2e234fef32f1ec1b74ad
Link:
https://www.unpac.me/results/409346b3-5786-4d57-a7fb-f612e1112839/
SH256 hash:
c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee
MD5 hash:
be2c7a5dad0f4b7e5d888bd0e7e7e5ec
SHA1 hash:
515710161ed03ec60dd25568c4e6691db4ca2663
Link:
https://www.unpac.me/results/409346b3-5786-4d57-a7fb-f612e1112839/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c2af1094287a8c19c349f3143cc64e31ebff881e1fc94e25dd79c2fd8856acee

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/166066/

Comments