MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f
SHA3-384 hash: b1fc457c36d515722e31fcf8ede19efc7d7d2e9516e2c08deb275ea04185fe788566c2140c8e869da3e89e316ee156e0
SHA1 hash: c4c3330188b53375ffe6e99ba3a5893339c99443
MD5 hash: 5650df6a69a3f2319f59f7a1dacc293a
humanhash: michigan-cat-moon-massachusetts
File name:e.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'092'096 bytes
First seen:2021-04-05 06:30:59 UTC
Last seen:2021-04-05 08:24:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:8+o5h0d9Z+biJm8o5hfOxGGvOZnOU5C8qhN:BZj1xGGGZ7C8qh
Threatray 3'772 similar samples on MalwareBazaar
TLSH 5F355AE631724A08DFE90B36502647F90EA07F326B9FFEBE74E43B491A38958D21115D
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: access-maritime.com
Sending IP: 64.44.139.179
From: ACCESS MARITIME <drychart@access-maritime.com>
Subject: MV Erge abt 5000 mts Steel Billets
Attachment: Port DA MV Erge .zip (contains "e.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e.exe
Verdict:
Malicious activity
Analysis date:
2021-04-05 06:46:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/74f55262-20bb-43ad-ac62-7505623fb04c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132155/
Detection(s):
SecuriteInfo.com.Artemis5650DF6A69A3.603.24565.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Replacing files
Deleting a recently created file
Sending a UDP request
DHCP request
Changing a file
Launching a service
DNS request
Sending a custom TCP request
Launching a process
Modifying a system file
Creating a process from a recently created file
Sending an HTTP GET request
Unauthorized injection to a recently created process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/88e05809-a3fd-4d37-ba39-810e698ac58f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/665814
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Creates an undocumented autostart registry key
Drops PE files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 381832 Sample: e.exe Startdate: 05/04/2021 Architecture: WINDOWS Score: 92 36 Found malware configuration 2->36 38 Yara detected AgentTesla 2->38 40 .NET source code contains very large array initializations 2->40 7 e.exe 15 7 2->7         started        11 99.exe 14 3 2->11         started        process3 file4 28 C:\Users\user\AppData\Roaming\...\99.exe, PE32 7->28 dropped 30 C:\Users\user\AppData\...\InstallUtil.exe, PE32 7->30 dropped 32 C:\Users\user\...\99.exe:Zone.Identifier, ASCII 7->32 dropped 46 Drops PE files to the startup folder 7->46 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 7->48 13 99.exe 5 7->13         started        17 cmd.exe 1 7->17         started        signatures5 process6 file7 34 C:\Users\user\AppData\Local\Temp\jk.exe, PE32 13->34 dropped 50 Writes to foreign memory regions 13->50 52 Allocates memory in foreign processes 13->52 54 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->54 56 Injects a PE file into a foreign processes 13->56 19 jk.exe 13->19         started        22 InstallUtil.exe 13->22         started        24 reg.exe 1 1 17->24         started        26 conhost.exe 17->26         started        signatures8 process9 signatures10 42 Multi AV Scanner detection for dropped file 19->42 44 Creates an undocumented autostart registry key 24->44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 06:31:30 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3hnjim3j52vabj7ltc3kaaz535gq6hewmg5rpfuxwkvwkpuh5m7q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0e360afe7e5de25783afb92588b7c54eee9413d21727c9379f813db1501c8ce3
AgentTesla
0ecfbf08398e1d0470c2f4d40a490808bd1b177cb60d674c5459d85f242952ab
AgentTesla
1e358cdd08320d9b811ec7772ac2d2e3eb2a4c2d61da189a3a6aaa0cff000c97
AgentTesla
233e814f54f8fa50dde3e233107cc7d2dbf72b6a02c10ca1299170321f143bd4
AgentTesla
826298b4d035818be292a13b27215db4d94733f28df50f94e9a93a5d3fea2190
AgentTesla
a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f
AgentTesla
a717f13ed10b05c55dea1f2551da0f2d2fb2e49cd153da93be3fdd618c5cee6a
AgentTesla
a8acff53e54f7454fd6dec6954f1505ec159f549f878a79f35d4cd5f512c09fd
AgentTesla
d65fa2504374d19e221d6631799f41426450d650355098be07f7cfa667d80bf9
AgentTesla
ec694537528f39e61c4a295e99932641ac2660f8580911790926294c4a190afc
AgentTesla
+ 3'762 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla agilenet keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210405-t798qkjxkx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Drops startup file
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
AgentTesla Payload
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f
MD5 hash:
5650df6a69a3f2319f59f7a1dacc293a
SHA1 hash:
c4c3330188b53375ffe6e99ba3a5893339c99443
Link:
https://www.unpac.me/results/a4f8fab4-c550-42a1-b510-8b188a4a54ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 35f024728f43c10ff3bda2090b9333b12bd5a3ab5c4e4f9a68fa1b4e93ff651e

AgentTesla

Executable exe d9da943369eeaa00a7eb98b6a0033ddf4d0f1c9661bb179697b2ab653e87eb3f

(this sample)

  
Dropped by
MD5 f90a156866c5d6a9f3d388d50348d7ca
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 35f024728f43c10ff3bda2090b9333b12bd5a3ab5c4e4f9a68fa1b4e93ff651e
Cape
Cape
https://www.capesandbox.com/analysis/132155/

Comments