MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a
SHA3-384 hash: 24ace20ddc7dd757b72982f186a7d85a4a7868e6a772273c90535bded737ba8c355daa8f5601160338eeaf8f7d9942a6
SHA1 hash: 0bee8c4c16118b53bdb0528990f37979481fdc19
MD5 hash: d1d3001298106331eddcfb7f927debe5
humanhash: grey-california-uniform-echo
File name:archivierter Katalog.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:371'200 bytes
First seen:2020-12-09 10:45:48 UTC
Last seen:2020-12-09 13:02:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:r+w/nH/Dl6noMrggu/EFKbgh2UU6AScCbnnnSIfH4ytKT6nWcHT5vN2crCw4ppJy:/6n10
Threatray 1'760 similar samples on MalwareBazaar
TLSH 4C840DDEAF384F71E1285E36BD9D2D3A57792E123D6DB5072C84788256F2F8406B0D28
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: office@schrottwolf.at
Reply-To: office.schrottwolf@email.com
Subject: BITTE ZITIEREN
Attachment: archivierter Katalog.iso (contains "archivierter Katalog.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
archivierter Katalog.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 11:51:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/35f03019-1105-4416-bb51-725cf6a7ffe4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107441/
Detection(s):
SecuriteInfo.com.FileRepMalware.2688.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a process with a hidden window
DNS request
Creating a window
Adding an access-denied ACE
Creating a file
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/558880
Signature
Binary contains a suspicious time stamp
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Creates autostart registry keys with suspicious names
Creates multiple autostart registry keys
Drops PE files to the startup folder
Hides threads from debuggers
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 328544 Sample: archivierter Katalog.exe Startdate: 09/12/2020 Architecture: WINDOWS Score: 100 54 g.msn.com 2->54 62 Multi AV Scanner detection for dropped file 2->62 64 Yara detected AgentTesla 2->64 66 Connects to a pastebin service (likely for C&C) 2->66 68 2 other signatures 2->68 8 archivierter Katalog.exe 18 4 2->8         started        13 archivierter Katalog.exe 2 2->13         started        15 archivierter Katalog.exe 2 2->15         started        17 3 other processes 2->17 signatures3 process4 dnsIp5 56 hastebin.com 104.24.127.89, 443, 49719, 49726 CLOUDFLARENETUS United States 8->56 50 C:\Users\user\...\archivierter Katalog.exe, PE32 8->50 dropped 52 archivierter Katalog.exe:Zone.Identifier, ASCII 8->52 dropped 74 Creates an undocumented autostart registry key 8->74 76 Writes to foreign memory regions 8->76 78 Hides threads from debuggers 8->78 19 InstallUtil.exe 2 8->19         started        22 timeout.exe 1 8->22         started        24 WerFault.exe 23 9 8->24         started        80 Injects a PE file into a foreign processes 13->80 26 timeout.exe 1 13->26         started        34 3 other processes 13->34 58 192.168.2.1 unknown unknown 15->58 28 timeout.exe 15->28         started        30 InstallUtil.exe 15->30         started        60 104.24.126.89, 443, 49738 CLOUDFLARENETUS United States 17->60 82 Creates autostart registry keys with suspicious names 17->82 84 Creates multiple autostart registry keys 17->84 32 timeout.exe 17->32         started        36 2 other processes 17->36 file6 signatures7 process8 signatures9 70 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 19->70 72 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 19->72 38 conhost.exe 22->38         started        40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 conhost.exe 32->44         started        46 conhost.exe 36->46         started        48 conhost.exe 36->48         started        process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=274etqepyykkz2wfxrx5qomgqvgqjniypwstp3gau7pph5fieufa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
3b8067fda3a018631e93bcc5e5ab73c56adc91c4964c45c092d42f2cc9acea6e
AgentTesla
54297a66291e2f879e2eaae44cb06032719d69299968e28c237f6315fe1d7eb1
AgentTesla
7323b8d5a71d744ada47370e02c8d86eb551bacb6881aee27ed7ec61cc22e068
AgentTesla
931b74dae99d57d93b21fb72c0da9184b83e04f95e024e9a7990a6c57a73ac7e
AgentTesla
9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb
AgentTesla
b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
AgentTesla
da4e120e4586c277edfa8a75a76f502a53c60594caee8b0bdf452220c9c61efb
AgentTesla
+ 1'750 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201209-r24699axsj/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a
MD5 hash:
d1d3001298106331eddcfb7f927debe5
SHA1 hash:
0bee8c4c16118b53bdb0528990f37979481fdc19
Link:
https://www.unpac.me/results/78832906-236f-4472-bfcb-651095ed5dc2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso d526001661111276d5bf9a11dcc973bec7e0d2390cbaadd61440876f4b97c520

AgentTesla

Executable exe d7f849c08fc614aceac5bc6fd83986854d04b5187da537ecc0a7def3f4a8250a

(this sample)

  
Dropped by
MD5 d0d22f9b098e34fa30087dc4d9ba5278
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/107441/
  
Dropped by
SHA256 d526001661111276d5bf9a11dcc973bec7e0d2390cbaadd61440876f4b97c520

Comments