MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddc70e7ecdc63f097430ab64077a89d274ad86e24d1df1a0a891aff83a9738b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddc70e7ecdc63f097430ab64077a89d274ad86e24d1df1a0a891aff83a9738b1
SHA3-384 hash: e11338199bc065d10f3f13c2e40ba24a5e9ddd25b7618b7caa5d06262285bf82f7d36aa16615f80fff0956fb338efc4b
SHA1 hash: c1d964e904c605ebf8667bd5c9a56d33dbe68c95
MD5 hash: 7cb9b12b5d81f1c5a587b4eb3be15d59
humanhash: grey-pasta-romeo-florida
File name:URGENT ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:606'720 bytes
First seen:2021-06-02 13:04:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:oHtY2iN6hImpq/FdQL1G8QA1sBBUzNdU2z953jxOd7LC:oHtY1gh7U3zbIp+2TxO1e
Threatray 5'518 similar samples on MalwareBazaar
TLSH 22D4129077FDEF02E47E17F63AA120100376AA749962F71F0DD90AED2E727804651B6B
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
URGENT ORDER.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-02 13:09:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b369f66b-332f-44b8-b32b-6ffde0908634

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/164067/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/795930
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 428338 Sample: URGENT ORDER.exe Startdate: 02/06/2021 Architecture: WINDOWS Score: 100 20 Found malware configuration 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected AgentTesla 2->24 26 7 other signatures 2->26 7 URGENT ORDER.exe 3 2->7         started        process3 file4 16 C:\Users\user\...\URGENT ORDER.exe.log, ASCII 7->16 dropped 28 Injects a PE file into a foreign processes 7->28 11 URGENT ORDER.exe 7->11         started        signatures5 process6 process7 13 WerFault.exe 23 9 11->13         started        file8 18 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 13->18 dropped
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ddc70e7ecdc63f097430ab64077a89d274ad86e24d1df1a0a891aff83a9738b1/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-02 12:50:16 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3xdq47wnyy7qs5bqvnsao6uj2j2k3bxcjuo7difisgx7qouxhcyq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
067173ee180295fa8ab38ce36f7fac2c29aa554e8d814054c549f443ce33a4ed
AgentTesla
0b277825df78139d46171f324c582866a81252fdaec3c8912fee41fb6f6172e2
AgentTesla
139e0682e4985353d6d73c2c0c8a0982a06a6f8758edb5b7f949282b5cbbd63a
AgentTesla
29af8f9271305888d917e56e139a3d9e8b4dfa0f5487f6604e9eba035e0d475b
AgentTesla
353b7ee12c1729df1d1e235dd4437810d6a006f3b3c74511d4895844d07303bd
AgentTesla
84fe49ddfb1a7e1b6650a7fd180ecd6604802fc19c69d7b0e24b641cbc0ede25
AgentTesla
852b82a6008df4460984881ca504c037e53f76ba11d4503f04312ed8f88fae12
AgentTesla
a12f642139a7cfe0891e40b83400cae049a06c959f742700d47f096ccaa32736
AgentTesla
b08161f518814ca5bb0fe0e4e7b0031b422342f4bfac77d817d4b727437c719d
AgentTesla
bc85f180f9bbf93ebc17983512fc302bb71b2534aa3aae9d721c9ac252fbade9
AgentTesla
+ 5'508 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210602-qxegfjgmts/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/ddc70e7ecdc63f097430ab64077a89d274ad86e24d1df1a0a891aff83a9738b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ddc70e7ecdc63f097430ab64077a89d274ad86e24d1df1a0a891aff83a9738b1

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/164067/

Comments