MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2
SHA3-384 hash: be36fb11fdb2fae5fa5504449c05b91028f00ae346bb692d42cbb013aa2f245df708d5573f283380e86ed83170a72dee
SHA1 hash: 9446e35cf1ced7be7ab053fa8a5818d596ea4404
MD5 hash: d944702f45a084c4ee3fa2a22c261da3
humanhash: arkansas-hydrogen-triple-six
File name:maxe.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:281'271 bytes
First seen:2021-03-04 15:00:50 UTC
Last seen:2021-03-04 16:38:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:l8LxBjEyfaRsyM3HJxSrguoVMfbyQc+JuJSqy0yNmy:0KRaH7cLo2yQtJuUq3wn
Threatray 2'991 similar samples on MalwareBazaar
TLSH 3354128B97E188BAD8E181F00E7E37BFF77A4511351196478F148D5B69298DFB30B282
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
maxe.exe
Verdict:
Malicious activity
Analysis date:
2021-03-04 15:02:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6f7afd6a-0482-491c-a9fe-c2cc10e78742

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122290/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/628747
Signature
.NET source code contains very large array initializations
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 11:19:23 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3sua3oohvxuuuuegad6mhgboh6h7fewumthtaqn25dgbmahxcwra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
168d180de146160d0ba93335e36e00d62029ea13f0a41ace68a76e8a2b547ac3
AgentTesla
181929c58e5ce4833a2847c9ff077dd87e8c0128793217d7e690311087ecc80a
AgentTesla
27dcd9778b97a02454b9d43e22c188cbc7028367b311496b463a6f7d773e9f6f
AgentTesla
569d9358801eb518b152cb73009131508a3f14b136b0eb80025ccf438865a440
AgentTesla
a09cc41fc5c688ee8d659a26c7a50d422513b8fc6a1636ae091a1572855a5041
AgentTesla
b2b6eff8a6c60704b212b98e6eb03be8bd26e1dc3bd8b6f28774bd6a52badb6d
AgentTesla
b9c82068f2880f34b3bf0dfb60d5c14c51d9317845cc58cb181a1e2639a960c4
AgentTesla
e769369f1fd04a2fdb3976c69cbaaefee66cee1f54f523d7eab4712ce764f73f
AgentTesla
ead0f6ef88c149f4318129ed6e3ef5fb30bd2ab03afef3625ca08d1b2f6f180e
AgentTesla
f7af12b666ffa2eb7f5c8a4bdf258b4b47138f8fe21f7f11271581caa891918d
AgentTesla
+ 2'981 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210304-trekspbk1x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Unpacked files
SH256 hash:
68be4a2e2a66eb4e33ee6ca0faeb976e735a788763779afb029c005d96d64b64
MD5 hash:
d76868d38874ca7bd124c43b447f5897
SHA1 hash:
80de783e920d26b33eb0239e398f7a9a066692c7
Link:
https://www.unpac.me/results/3d1672a6-ab3d-41dc-b0cb-a830a7f44564/
SH256 hash:
0ff5a1fbd9debbfc567a2b0d90815868b95294b1244bfdf65dc863d69922d6a1
MD5 hash:
de62484921e87d2aa871ac47f1df6bc3
SHA1 hash:
0065c6ca818b3d6343c84f29a6d68be3e59beedc
Link:
https://www.unpac.me/results/3d1672a6-ab3d-41dc-b0cb-a830a7f44564/
SH256 hash:
3d1ef6d61a62ef034afe654f4c5295aba3dec12411a5989560ba4f08b8e2748e
MD5 hash:
70578cd420a93cc5c18ef1be7a9a27d9
SHA1 hash:
a5b748bed82615b7715e96879b3aac78c299d452
Link:
https://www.unpac.me/results/3d1672a6-ab3d-41dc-b0cb-a830a7f44564/
SH256 hash:
dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2
MD5 hash:
d944702f45a084c4ee3fa2a22c261da3
SHA1 hash:
9446e35cf1ced7be7ab053fa8a5818d596ea4404
Link:
https://www.unpac.me/results/3d1672a6-ab3d-41dc-b0cb-a830a7f44564/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/dca80db9c7ade94a508600fcc3982e3f8ff292d464cf3041bae8cc1600f715a2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/122290/

Comments