MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3ee5744817862d7e419d46ec2f89238c64d8fb18b3acf15863396143039bd63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3ee5744817862d7e419d46ec2f89238c64d8fb18b3acf15863396143039bd63
SHA3-384 hash: 35b51012e145ddfcb2bdafad991ecb2081dfb9c3d59d137cce9bff1bfde00b06acbc665b5a99c0314fdc70a79a41c2e2
SHA1 hash: c0469f8bc26afbbe1e759358698777cbfd9801c3
MD5 hash: 0869388a3ce9c3968a5b930f3dd33868
humanhash: illinois-sweet-thirteen-timing
File name:Swift Advice_MT103_ORTT00702117405_[[-Domain-]]_12-07-2021.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:687'104 bytes
First seen:2021-07-13 12:08:04 UTC
Last seen:2021-07-13 12:34:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:ejY7B8niNRVZqD0lLlizYpL1aiIvraXPhrar1WP1lwhR6cV1PJ9zEDO4ilE5TyRc:eshrTlpL1JIu/hrY1WMTz94ic5yR3
Threatray 6'950 similar samples on MalwareBazaar
TLSH T103E42338DE16A827C1BE057226BAD6E05B77E69558A1CF3F313DA34D1F333512A82247
Reporter malwarelabnet
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Swift Advice_MT103_ORTT00702117405_[[-Domain-]]_12-07-2021.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 07:12:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/40921bed-5989-41fd-9c95-8f83926f0c25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171365/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37229033.22521.13651.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/80e71045-3a02-4875-9a46-7cc4db910013
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/815510
Signature
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 447921 Sample: Swift Advice_MT103_ORTT0070... Startdate: 13/07/2021 Architecture: WINDOWS Score: 52 32 Multi AV Scanner detection for submitted file 2->32 7 Swift Advice_MT103_ORTT00702117405_[[-Domain-]]_12-07-2021.exe 3 2->7         started        process3 process4 9 powershell.exe 7 7->9         started        12 powershell.exe 9 7->12         started        14 powershell.exe 5 7->14         started        16 22 other processes 7->16 signatures5 34 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->34 18 conhost.exe 9->18         started        20 conhost.exe 12->20         started        22 conhost.exe 14->22         started        24 conhost.exe 16->24         started        26 conhost.exe 16->26         started        28 conhost.exe 16->28         started        30 19 other processes 16->30 process6
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d3ee5744817862d7e419d46ec2f89238c64d8fb18b3acf15863396143039bd63/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 03:41:32 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pxforebpbrnpzaz2rxmf6eshdde3d5rrm5m6fmggolbimbzxvrq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
126f752c7dec6c513804a0737e5d0a03cd8a1082923d68aec35979f3a7db7d60
AgentTesla
337a895245dcdbe522c4320dbe1dfd62e346aecad8246f9b895a5460211865b0
AgentTesla
360dc7aa2889b1ed05b553eccab73348de2fae89cd7742e64422712298b670ca
AgentTesla
3ed17d1df70b71852be2335f91bdfe20cd4a319a7d22d407e6e82a8dbe91bc5f
AgentTesla
4065ef6148d82e9b20fb8fb21b7969636fdc0218259f069adffabd3b2882cc81
AgentTesla
7868ece7b29dcba357ff00b1e0394b6e8062eae5512c08a0dea575c2d4f55230
AgentTesla
87178907c9c47a383a2a08a30481dbc5345b6c85c48142a855900d9840e6b6da
AgentTesla
913accbcc9537c110e0ec272f0aaafa7e8a1fd1a3f525fa7d961ce894a246a60
AgentTesla
dea2e88e71d3b38500aca694a9ba1f476d8db14e5389a2cf70b23cad51eb33c9
AgentTesla
e69ebaafa96ca91f70472ad65cfbc6483f65911e715c8eede2707697aca8f077
AgentTesla
+ 6'940 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-bkgwty6nte/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Executes dropped EXE
AgentTesla Payload
Nirsoft
AgentTesla
Unpacked files
SH256 hash:
b9794b77138a02b9625c56fe666191038ddfe3ec958bbfbd75b5032db3855ba1
MD5 hash:
39b1162b42ab34ea82e0449f68249cef
SHA1 hash:
9ac3351beea7663e94bfac96f2c50ecc0e92cfb0
Link:
https://www.unpac.me/results/71771ba9-7a31-4a81-a302-5accf4e4b3bf/
SH256 hash:
70b6b517fa087ee702b293fe6b44455f4da0cd41dbcf58afee9baf19789506c1
MD5 hash:
eefa94dc5ddbfebc923434949710f747
SHA1 hash:
36e5b16fdcf7cd20c93b771854d169882fc14155
Link:
https://www.unpac.me/results/71771ba9-7a31-4a81-a302-5accf4e4b3bf/
SH256 hash:
d3ee5744817862d7e419d46ec2f89238c64d8fb18b3acf15863396143039bd63
MD5 hash:
0869388a3ce9c3968a5b930f3dd33868
SHA1 hash:
c0469f8bc26afbbe1e759358698777cbfd9801c3
Link:
https://www.unpac.me/results/71771ba9-7a31-4a81-a302-5accf4e4b3bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d3ee5744817862d7e419d46ec2f89238c64d8fb18b3acf15863396143039bd63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/171365/

Comments