MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a
SHA3-384 hash: b622114c22acbefd52b40804d6f5b0243eda3f8867d36b34015bdc44f2abee8588650024a5f6bed7d33997a9c430501a
SHA1 hash: e6628b84a3302208ee1e518a7c056407905cb410
MD5 hash: c2d504474ebf64598c7211c3bf35586b
humanhash: oscar-mockingbird-victor-stairway
File name:Statement Of Account.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:734'720 bytes
First seen:2021-07-06 05:20:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Rn+WPXljQ0k6dNEWe8cGbnbdYXwZhcia0ANkUWsb:RI0qwnFhGLmUWsb
Threatray 6'362 similar samples on MalwareBazaar
TLSH F9F4DF6812F8999DF5FF4B7EE5A96111C7F4B6626213FB2D2AC010AC1C73B50CD82267
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Statement Of Account.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-06 05:22:30 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a30797ff-c2fa-4f80-8780-d2a79b8b2142

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/169834/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.13608.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/33dda16d-0d23-43f9-a50e-fa6d46b80c71
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/812033
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 444444 Sample: Statement Of Account.exe Startdate: 06/07/2021 Architecture: WINDOWS Score: 100 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected AgentTesla 2->28 30 5 other signatures 2->30 7 Statement Of Account.exe 3 2->7         started        process3 file4 20 C:\Users\...\Statement Of Account.exe.log, ASCII 7->20 dropped 32 Writes to foreign memory regions 7->32 34 Injects a PE file into a foreign processes 7->34 11 RegSvcs.exe 2 7->11         started        13 RegSvcs.exe 7->13         started        15 RegSvcs.exe 7->15         started        signatures5 process6 process7 17 dw20.exe 22 6 11->17         started        dnsIp8 22 192.168.2.1 unknown unknown 17->22
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-05 10:57:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
22 of 46 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zcvcr4iuhpz47ovaubtrbgewkoglx626vqepsiv7fb6rfr7sssfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
391b6232d50e461350b542c090a32e512bfe103880bd8236414723763e840e17
AgentTesla
5538adf3e8e18614c6eb877e10850986b564efbe9870c4027e2b38bcf8ccaf41
AgentTesla
6ba154c8b1cfba628eca53b031ab744e1c71c2af0db0ac0865f952de2c08d475
AgentTesla
6e2334100ce6870c4514641402272be6059ee35f27569796097c7dd0ac612917
AgentTesla
8ea48d82d969186e109b46c639ff2ef0a18b6654cbd1a26ddccc26ccd6a6dc35
AgentTesla
905a69a36fb36ef3a1def54f23b03ce216458d2966fe623af8e7430f079a5681
AgentTesla
91ba1657c0a2a9677788cec7099212b28934a81b0511607a11a70a4f89259901
AgentTesla
a55214b168e93fe4d57929c0be8defba307cdaf0ec00b39f3008c32787bbfa7f
AgentTesla
fbce0736924f708043956b1b6abe1f2a32a7db59a180de9c0d0be0f38570f871
AgentTesla
fe24a2b0b07d806e55c075d1c0de7f817b03f9faa23eeba5370ba6acd8272ecd
AgentTesla
+ 6'352 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210706-jpcdp3bcx6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6f7199d9af6f9a361be396b46733422a944d1ec88294f90c07c91c61d63cd1b9
MD5 hash:
860900a280d6d1ca47de43ea7a7dbb83
SHA1 hash:
e6066b6cff380becaf30120ed30b7f8a4baaeb85
Link:
https://www.unpac.me/results/c57a2be2-9026-42b1-b10e-ffef45438958/
SH256 hash:
d1d2749ff0dab6bb263ea0e98a9ba9c0ea0c1187f99926a96446d0da023a2571
MD5 hash:
8e48f627032f06547f304b2671629421
SHA1 hash:
8cbc21f04af3fd2001052b6957184075767f5723
Link:
https://www.unpac.me/results/c57a2be2-9026-42b1-b10e-ffef45438958/
SH256 hash:
15410a0d386bb1e79b50d28164568012c58c29d7ba80421a4f68c58237e5d63d
MD5 hash:
0d57de078012f85a855dade352207392
SHA1 hash:
056969e8972ddf86a5ae3f49ce90278ab35b7f27
Link:
https://www.unpac.me/results/c57a2be2-9026-42b1-b10e-ffef45438958/
SH256 hash:
c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a
MD5 hash:
c2d504474ebf64598c7211c3bf35586b
SHA1 hash:
e6628b84a3302208ee1e518a7c056407905cb410
Link:
https://www.unpac.me/results/c57a2be2-9026-42b1-b10e-ffef45438958/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:adonunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:AD on UNIX
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4896ac52f78034e703736e9cfe3d2cc1b4088e821c2dd4ff55c531c141415af2

AgentTesla

Executable exe c8aa28f1143bf3cfbaa0a067109896538cbbfb5eac08f922bf287d12c7f2948a

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 4896ac52f78034e703736e9cfe3d2cc1b4088e821c2dd4ff55c531c141415af2
Cape
Cape
https://www.capesandbox.com/analysis/169834/

Comments