MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1138093b257391f3536101486b81d14553e4ce15ed608058fd23836a2f95759. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1138093b257391f3536101486b81d14553e4ce15ed608058fd23836a2f95759
SHA3-384 hash: 1d08c84d920ea89cc37a5dfaeed78d8be1f14897ddd1f2c240566c1fb36ff911c820a218c95d0a4f1c0d8c78514e295c
SHA1 hash: 848debedd0e33b30fcd60ce1716c5ea03238ac7d
MD5 hash: 1faeabd44f6c439dd3035608920ff586
humanhash: carpet-december-fifteen-apart
File name:Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:903'168 bytes
First seen:2021-07-13 15:19:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:NXN5GnTOdU+CHpZgzT8/dEt8WvOPZJDS2kr9HzDhxUKEqFc2uLfb4WNNi4NRZWuN:DiyOPZvkr9TDhxU63uLfb4if7ZWY
Threatray 6'682 similar samples on MalwareBazaar
TLSH T1A8158C2C23FEA209F277FE71DF64F3448E567B76D125894E39C012065862E82BE76532
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 15:22:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a3979755-9d6b-45fe-9d15-bf8f550a9562

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171462/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.925-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dbb29bfc-7e48-4e6a-b742-da84959dd004
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/815704
Signature
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e1138093b257391f3536101486b81d14553e4ce15ed608058fd23836a2f95759/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 15:19:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ejybe5sk44r6njwcakinoa5crkt4thbl3laqbmp2i4dnixzk5mq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
086b930d1a631edf83cfe41204603a67e9cf4661ecee97761f7dcb8f87bb6e70
AgentTesla
2361e8542045dddfaa5e2e6dfc49db670b687dcfa00e7877830de468bc076e38
AgentTesla
528c4017fc8019572354de7746bba7978bb1ce0c9508e42644799712fb5ea869
AgentTesla
5bb1ec5f6be562ca2beec31d45c6cce4b811283b225e3f2654dbfbe5cc8f07de
AgentTesla
988015476a43d916c6d49009eaa2e262246ac18eaf1615113262cd3540708450
AgentTesla
9c945e3dd82b26e5b6e2bc96a1aa6fdc1365235e6479c143340073fc831048fe
AgentTesla
c6cacd1d2bfb210318a62cabce8045f5735cd9a0e58c3aea8d3ec2174f6d7abb
AgentTesla
c7607bcbc0acfdf8733dff8a4f709009236da553d300abc2d0df98b3e6c70f58
AgentTesla
df54a04599bb3953ffcf067a4308e01dafe8ac2c9064bdd3fbc3a441725a06f2
AgentTesla
fe71bef6acadf2feb1a19c9e51543be0cacb245a5ce034b7510c72912996580e
AgentTesla
+ 6'672 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-gssywt56pn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
Link:
https://www.unpac.me/results/4050821d-2db0-4835-bf7b-a9edb1536212/
SH256 hash:
149a30a091f285e7cd7812782d85a0bd2769059f7bee1d247eab5dfb3e987ebd
MD5 hash:
64a9e4f6e0c054fa82b1b5350123f92f
SHA1 hash:
3565d6b5a928352bd2e633d2334b87c3bf98e195
Link:
https://www.unpac.me/results/4050821d-2db0-4835-bf7b-a9edb1536212/
SH256 hash:
1a081afb69855a64b6f2b12670dde9f0134582ab7a2bc640afddc1ed8f0102e1
MD5 hash:
8118ba926bf739de06b9ac5555769a55
SHA1 hash:
1783ace313706231011d2e466419240a71746fe0
Link:
https://www.unpac.me/results/4050821d-2db0-4835-bf7b-a9edb1536212/
SH256 hash:
0e805536072bad719a3b92425c0d4b055bc28dbd0caa4f5cbb9e1f26e99c4833
MD5 hash:
d4f32e76b798d71caf05fcf35583f69c
SHA1 hash:
0267272141a96b156fe769e3733a2e727cf53a2f
Link:
https://www.unpac.me/results/4050821d-2db0-4835-bf7b-a9edb1536212/
SH256 hash:
e1138093b257391f3536101486b81d14553e4ce15ed608058fd23836a2f95759
MD5 hash:
1faeabd44f6c439dd3035608920ff586
SHA1 hash:
848debedd0e33b30fcd60ce1716c5ea03238ac7d
Link:
https://www.unpac.me/results/4050821d-2db0-4835-bf7b-a9edb1536212/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e1138093b257391f3536101486b81d14553e4ce15ed608058fd23836a2f95759

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/171462/

Comments