MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df107977e92465958c206bf42e33ce394e8573da3c4035b69bfa0d0eaf367914. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	df107977e92465958c206bf42e33ce394e8573da3c4035b69bfa0d0eaf367914
SHA3-384 hash:	abba94e4b0ce27a3c17d886b1887040d2775297597345b1b867ebd374687ce2932017ec6054f4f6c75db0384d0613cf0
SHA1 hash:	5ed4fd1e8a4e7dbed31928c2b7dd2ca1043cb68e
MD5 hash:	ed6f9a5ace6367f4e532dd4ec40762ac
humanhash:	yankee-tango-nitrogen-music
File name:	Arrivalnotice2020pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	387'584 bytes
First seen:	2020-11-27 13:15:54 UTC
Last seen:	2020-11-27 14:44:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	be74bcf76a56fe7a35a0a7f280acf926 (2 x AgentTesla)
ssdeep	6144:3H5RPXz5XmxrAtJPsorVF3obF8V33f35XHC5UelMPBevP/539VI7hv9u998Q:X5RfzJmxrkBsor7aF8V33h3lerf5s7h6
Threatray	1'539 similar samples on MalwareBazaar
TLSH	F484E00172C0C0B0D86343754969D762467DFDB68FA69A9F7BC84E8D0EB81C0AB757A3
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

125

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/105814/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a window

Sending a UDP request

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/549332

Signature

.NET source code contains very large array initializations

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSBuild connects to smtp port

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df107977e92465958c206bf42e33ce394e8573da3c4035b69bfa0d0eaf367914/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-27 13:16:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=34ihs57jerszldbanp2c4m6ohfhik462hradlnu37igq5lzwpeka._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d

AgentTesla

554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a

AgentTesla

67bff3c99f10c2b189df24202f66a3901d355847afee7de4f66c78aff794c923

AgentTesla

6b6a6cb45c75ffda98874ecb88f2fbc1ec1737222116967459117d6d8d36ecc9

AgentTesla

6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58

AgentTesla

9c7002e97c59c4c190abb09e373a5f1010b4790dbcb714e792538e73820d5609

AgentTesla

ca7eebfdd882ee2f0c0fa96965ade9378129afcef2302faac6391b9fba82debc

AgentTesla

e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0

AgentTesla

ecf592d2aed1d17b4c75e72a40edeb9b4396c8c9181cee7519ebe63bb7391870

AgentTesla

+ 1'529 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201127-s17j5dbyrn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

01d050ecf711f1d4f97e921c73b8d77c035bbbc1f99fe69be0fbec568220c7f6

MD5 hash:

1bda1d155ae8ef1785464a2e878962c2

SHA1 hash:

f76f168cae19acfaa5a82fc5db7ae9bfc2000d96

Link:

https://www.unpac.me/results/0ce59d12-9f0c-405c-89b2-4f385e37d885/

SH256 hash:

df107977e92465958c206bf42e33ce394e8573da3c4035b69bfa0d0eaf367914

MD5 hash:

ed6f9a5ace6367f4e532dd4ec40762ac

SHA1 hash:

5ed4fd1e8a4e7dbed31928c2b7dd2ca1043cb68e

Link:

https://www.unpac.me/results/0ce59d12-9f0c-405c-89b2-4f385e37d885/

Malware family:

AgentTesla.v3

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/df107977e924/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.