MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b
SHA3-384 hash: cd39315a90a88cc63ff184904c1a5befeb63267ca00ae81719c9b96374415095295a1c23182ccf3421466c2997f8fe59
SHA1 hash: 63d6ffe6ce9cd9d821aa241d0ea8df0eb6b6ba14
MD5 hash: 06ac3ffeac59f118a691bcd0b875e99a
humanhash: mockingbird-crazy-indigo-crazy
File name:06ac3ffeac59f118a691bcd0b875e99a
Download: download sample
Signature AgentTesla
Create hunting rule
File size:928'256 bytes
First seen:2021-06-22 08:32:50 UTC
Last seen:2021-06-22 11:42:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:L32WFHm4uSMPQipP5+wnJ3efWVu3bdU2hvZEPFW9cPV5DMz:BHpRipbn1ee03bRR966
Threatray 6'037 similar samples on MalwareBazaar
TLSH 1515A0260ECF421AE2754EB65770BC47C3B66EA62A05B2113EC032EDC9375DADCEE511
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
payment.doc
Verdict:
Malicious activity
Analysis date:
2021-06-22 07:54:10 UTC
Tags:
exploit CVE-2017-11882
Link:
https://app.any.run/tasks/263bd8e5-dfe9-47d0-9398-89ca67a9e530

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167497/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.8567.19428.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/30ee2ba0-5be4-410c-b07a-0836900fbd62
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/805831
Signature
.NET source code contains very large array initializations
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 08:33:09 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb
AgentTesla
3e43fc7961678765fa09b867e27d15c9246bdd19f599a7b6e1ce215f3c03f104
AgentTesla
473ec4f2b7a198ff36e66b86cbc05848883b4dffeaacb8b9c97e67e88e977986
AgentTesla
55c05e011a2ed69bb4c04240820f50c433ffcda3d0792ea25c7cd272322112d8
AgentTesla
7e07c98e0f97b46db236ef8765108ce7bb484e29dab1da0924de402ff3b84bdd
AgentTesla
8e5208c98e4ca5ec839db60d07d5a7c2103f098e5df72744680ccd7f73b0b56f
AgentTesla
a42d9bd273be9ffd1ca60def6f75fab502c7d04967bc69fe9ee7c8304d80bf16
AgentTesla
c26273df586c447ec9f449497926c19638899f5b5a22ca956fc318e617e89cf6
AgentTesla
c3563e777c01c0ea26f7a8f26e598dacd68d096966011da76a5311f09ba21614
AgentTesla
e7e13a17b68aa61a6adf579f4bf9994e92e9cae1788e0161e18969de98095003
AgentTesla
+ 6'027 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210622-se26vnwfga/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
18c016736dee080c8558c86a562c7cb4da2559513cadea9963e097edb015039d
MD5 hash:
d28520b5b87871615ff5e8bb55971175
SHA1 hash:
96e5c7394206165cd64f97ad27a5c8958bce1391
Link:
https://www.unpac.me/results/4e58ce0f-2077-475b-8630-7b237159b252/
SH256 hash:
b927718f9bcfc18a6225f4be06b13ee5873e8793df09fe9f1b4e59f3f3544715
MD5 hash:
8ffb190e9062bc848a3b634d169db9de
SHA1 hash:
740de1a370f08a9b1b997a71f873c36e80880c66
Link:
https://www.unpac.me/results/4e58ce0f-2077-475b-8630-7b237159b252/
SH256 hash:
5d955d3691d3df935db49746e95ca95cde7db36b617c394478141debcc93b904
MD5 hash:
4ae2c6c3246e4f52b518ae48f331c484
SHA1 hash:
19c9f675a35c9ef1c5349c1cb934613d0345bda0
Link:
https://www.unpac.me/results/4e58ce0f-2077-475b-8630-7b237159b252/
SH256 hash:
d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b
MD5 hash:
06ac3ffeac59f118a691bcd0b875e99a
SHA1 hash:
63d6ffe6ce9cd9d821aa241d0ea8df0eb6b6ba14
Link:
https://www.unpac.me/results/4e58ce0f-2077-475b-8630-7b237159b252/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1387679/
Cape
Cape
https://www.capesandbox.com/analysis/167497/

Comments