MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6
SHA3-384 hash:	d463d3dd9e25a9c338e6460bce75e5715b42c956550c6aadfa988238640813dd95830a841de33b05f8672142e9617063
SHA1 hash:	ebcbb87c0f358eb0290485da13bb9da54b8ae6fb
MD5 hash:	9de18eb105d6b3f19718f968ecec5359
humanhash:	batman-lithium-item-london
File name:	BILL OF LADING DOCS.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	902'144 bytes
First seen:	2020-11-05 07:18:24 UTC
Last seen:	2020-11-05 07:19:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:TJBmr0hyj5re8VxdxqlfAVMzeJPyTm0lucEcgTP4cF3MsrnpbxWYn2YdSDiskcTk:TLcEq1pVxxlxYm0QiEP4cFcsjh2Jesf
Threatray	955 similar samples on MalwareBazaar
TLSH	CD15BFF6A246EA6AC80F043FF84B256193D9CF2D98F9814643C5F519137C6CE66EC48B
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/83073/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.cc.19859.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/520986

Signature

.NET source code contains very large array initializations

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6/

Threat name:

ByteCode-MSIL.Ransomware.TeslaCrypt

Status:

Malicious

First seen:

2020-11-05 07:20:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjdbiiivj4f7vknsjmhnl2txnxpp7slxly75wtnbgoo4ynjendda._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

09039ff8c6c08c31f158428d4f78123e5afc57f0751ab877d84011897c512f1d

AgentTesla

090b379ffd22f27e1070c2f56d6a7833a6f04451cd4b065571dd2e04e62faac5

AgentTesla

10bd64efbdb93ad3b777edc550b0d16bbaee95d365541937c1bb4a5a305683b7

AgentTesla

320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e

AgentTesla

63adb2924e560b5372169c820684773bba83fe0ab3e0b51ecf3192b0cda9d774

AgentTesla

6d7aca14eda81f9c5632aabd433fe88eeb84c03abf41a4098fa8d95ed71be490

AgentTesla

a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49

AgentTesla

e4179e2d5b9c04e7a59bf9b063c006f5695b5ec90600833006d38129ad0a48a6

AgentTesla

f1eda024214adb75fe2aa99abd7b2c8e8cecce443d80a0305a916bb8e03a2bf8

AgentTesla

+ 945 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

persistence

Link:

https://tria.ge/reports/201105-gflzxf1y9a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies service

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6

MD5 hash:

9de18eb105d6b3f19718f968ecec5359

SHA1 hash:

ebcbb87c0f358eb0290485da13bb9da54b8ae6fb

Link:

https://www.unpac.me/results/4aa6571f-b9b5-4216-ae61-88d1386f5b8d/

SH256 hash:

31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b

MD5 hash:

0aebe46040ceb011e78506d4985fe3de

SHA1 hash:

218ac1e7b14a66c604ec3042f8486bed9cd4c2c1

Link:

https://www.unpac.me/results/4aa6571f-b9b5-4216-ae61-88d1386f5b8d/

SH256 hash:

ca19cc5d904a377c3b70e423de3709c14485a1237d24310618db137a2047b8f8

MD5 hash:

7f6bdad6d454aaa9f2d0c1e361116d74

SHA1 hash:

90586aed826714d6b8dd8d7fe734d7c91e867786

Link:

https://www.unpac.me/results/4aa6571f-b9b5-4216-ae61-88d1386f5b8d/

SH256 hash:

a4964915b9e39587185cd9a632eabeb0983a1dae5da8676ad7753e6d592c3030

MD5 hash:

b593b94a2a8b9339c3b4567655373224

SHA1 hash:

98944294234bce9b651192e0e59a0ecd7671c7a1

Link:

https://www.unpac.me/results/4aa6571f-b9b5-4216-ae61-88d1386f5b8d/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.