MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627
SHA3-384 hash: e1a11910b8e71acf2bb14e332f1ac345e1c1936e6e27bc321bfcc913fa76d30e32d135f9486edf0b028a1dd3ee4af93a
SHA1 hash: 056dd4092069b7e039fbb0d041474ca21573fc47
MD5 hash: e06f874f07220c99d1052dbfdd3f7abf
humanhash: oven-east-skylark-beer
File name:DOC070920.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:467'968 bytes
First seen:2020-09-30 06:51:37 UTC
Last seen:2020-09-30 11:26:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:yRFHi4JvIc6yL1b3DzZEhx9nc/NAYS9hN8/WK:yRFZv5tTzs9crS9hs
Threatray 224 similar samples on MalwareBazaar
TLSH C5A4D00126C44367D0BFEB74642DDC4443F3D41AE26FEF1AEED9E4780B6FA8186A1646
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67026/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.3291.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/478066
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 291481 Sample: DOC070920.exe Startdate: 30/09/2020 Architecture: WINDOWS Score: 100 27 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->27 29 Found malware configuration 2->29 31 Sigma detected: Scheduled temp file as task from temp location 2->31 33 5 other signatures 2->33 7 DOC070920.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\Local\Temp\tmp987.tmp, XML 7->19 dropped 21 C:\Users\user\AppData\Roaming\meuxKIe.exe, PE32 7->21 dropped 35 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->35 37 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->37 39 Injects a PE file into a foreign processes 7->39 11 DOC070920.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 23 mail.rejuvilab.com 67.20.76.95, 49753, 587 UNIFIEDLAYER-AS-1US United States 11->23 25 smtp.rejuvilab.com 11->25 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->41 43 Tries to steal Mail credentials (via file access) 11->43 45 Tries to harvest and steal ftp login credentials 11->45 47 Tries to harvest and steal browser information (history, passwords, etc) 11->47 17 conhost.exe 15->17         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-30 06:53:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27z4y4qwh2ajwommqov3aszdpu7zad7orcdoqyuzlixftfod2ytq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1d92907e65f00792c2eecabf72a121dc5a2f53c9e85650eddc24ab6ad4a07e8b
AgentTesla
254e6d691fc7292fba06fc4f127d509743961835b12079ccc5a96f53ffee1648
AgentTesla
b3332f865f362bd89aaa305a8b8ec5d3e5b6ddae9e704b70a2d36723550415b0
AgentTesla
be2763ce4e6c5c6a228efc795006966af947a33bb7992121d9f139f161f7ab15
AgentTesla
c6a9e6b49e72daeffbffe9c46f56b5147d1885ff0b2c202558d794c258b71818
AgentTesla
c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0
AgentTesla
d3345db33851543b968f728d2a342c49dc72b0dc633da851518d8585e53af3ce
AgentTesla
e438d3d16690fe7c24844f8ebc7e2c5f66c2b24eb24b5d5f9afa9a863fa9d19d
AgentTesla
fb8be54633a272604b64a7b5a79b6d123b30d1763d2235e9d81a960b858328e4
AgentTesla
fb9170b75704e2202310a4ea95652f93cfcc6d4c4700055156ebb8e5532c4a9b
AgentTesla
+ 214 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200930-hlx5s8jdce/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c2c03cc60f569211b08631d6fd419227a1bfba7b4fd691fdc5d71cb5fbe98dad
MD5 hash:
9bc84902757be483f9cb74a17097a3b5
SHA1 hash:
3874e47e9af01a2a67a12760a7604b15a3faef53
Link:
https://www.unpac.me/results/41a1107f-7f20-40a3-91b5-e5b07cd53b35/
SH256 hash:
fe7620560595e2d426738b4ba1b116bf8a9893cad9fb3004405376f0f4c4ded9
MD5 hash:
b1b8866fe191c095394237c72d97a179
SHA1 hash:
96bfb40afc73fa7596ab9151aab77f98e2a42bfa
Link:
https://www.unpac.me/results/41a1107f-7f20-40a3-91b5-e5b07cd53b35/
SH256 hash:
6aac64e95cd075d365228d29a373eeb593098f3d2a6b3851eba30d5f2a590a4c
MD5 hash:
d8286164182dcff25e33dc23eb28ad98
SHA1 hash:
c101a08673f0ab28b5120c3b207659a5e4435057
Link:
https://www.unpac.me/results/41a1107f-7f20-40a3-91b5-e5b07cd53b35/
SH256 hash:
785261875049471f6432827571071af39fdb06ec0a223224c12792201a9f66e5
MD5 hash:
e41b095949e16c551511c80acfc18ac2
SHA1 hash:
c1c9299481d8604297151f48ac8c790c9e920504
Link:
https://www.unpac.me/results/41a1107f-7f20-40a3-91b5-e5b07cd53b35/
SH256 hash:
d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627
MD5 hash:
e06f874f07220c99d1052dbfdd3f7abf
SHA1 hash:
056dd4092069b7e039fbb0d041474ca21573fc47
Link:
https://www.unpac.me/results/41a1107f-7f20-40a3-91b5-e5b07cd53b35/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022

AgentTesla

Executable exe d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2d735a2ece5021016d14226f7199dce781837a307abb35b97a9076153348d022
Cape
Cape
https://www.capesandbox.com/analysis/67026/

Comments