MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13
SHA3-384 hash: e0a39808f33d093f002065656e2a3237d79b0e09f70d53e039a06ba4a4c95e8ba5ff3d0995ddeb589dc88cc9b889a407
SHA1 hash: 61b5d2000396d2633759aaea4e97f85e9c5ed606
MD5 hash: a719cd4c4453d777428de8038805b297
humanhash: mississippi-may-wolfram-september
File name:a719cd4c4453d777428de8038805b297
Download: download sample
Signature AgentTesla
Create hunting rule
File size:851'456 bytes
First seen:2021-08-09 06:06:54 UTC
Last seen:2021-08-09 08:48:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:88fKFWt2NjFmzPwatKB4o11FL3UUR/RA/uuOv5w2FEaAnph59QRIDOIqGZRfx:8KKFWMNjNa1IJ1OaAnZ+QOI9Z
Threatray 8'078 similar samples on MalwareBazaar
TLSH T19205DF10A3F8575AF9FBBB3DA971015467F1F913A735C68E2E5500CD8972F808AA2723
dhash icon 255a4b371b7b660f (11 x AgentTesla, 2 x AsyncRAT, 1 x RedLineStealer)
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RFQ-14000145819.doc
Verdict:
Malicious activity
Analysis date:
2021-08-09 04:57:40 UTC
Tags:
exploit CVE-2017-11882 loader
Link:
https://app.any.run/tasks/25053d05-df08-4a00-a9c9-ef8c655168b8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/177447/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.23608.16072.24226.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c5cde52-5281-4e76-bb56-02e31c71a62e
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/829033
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 461461 Sample: A7es0tMplv Startdate: 09/08/2021 Architecture: WINDOWS Score: 100 55 Multi AV Scanner detection for dropped file 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 Yara detected AgentTesla 2->59 61 3 other signatures 2->61 7 A7es0tMplv.exe 7 2->7         started        11 newapp.exe 5 2->11         started        13 newapp.exe 4 2->13         started        process3 dnsIp4 45 C:\Users\user\AppData\Roaming\KKeGhW.exe, PE32 7->45 dropped 47 C:\Users\user\AppData\Local\...\tmp15B7.tmp, XML 7->47 dropped 49 C:\Users\user\AppData\...\A7es0tMplv.exe.log, ASCII 7->49 dropped 71 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->71 73 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->73 75 Uses schtasks.exe or at.exe to add and modify task schedules 7->75 16 A7es0tMplv.exe 2 5 7->16         started        21 schtasks.exe 1 7->21         started        23 A7es0tMplv.exe 7->23         started        25 A7es0tMplv.exe 7->25         started        77 Multi AV Scanner detection for dropped file 11->77 79 Injects a PE file into a foreign processes 11->79 27 schtasks.exe 11->27         started        29 newapp.exe 11->29         started        53 192.168.2.1 unknown unknown 13->53 31 schtasks.exe 13->31         started        33 newapp.exe 13->33         started        file5 signatures6 process7 dnsIp8 51 mail.privateemail.com 198.54.122.60, 49727, 587 NAMECHEAP-NETUS United States 16->51 41 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 16->41 dropped 43 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 16->43 dropped 63 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->63 65 Moves itself to temp directory 16->65 67 Tries to steal Mail credentials (via file access) 16->67 69 3 other signatures 16->69 35 conhost.exe 21->35         started        37 conhost.exe 27->37         started        39 conhost.exe 31->39         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13/
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2021-08-09 00:38:36 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
37618200ca15f760f9eb09fcaa6a6e9f9591ea49c69d3db0a5e47af01913bb3c
AgentTesla
8331e9eaaa9b2296086c9b8e32c8a6146719c81dd48503a974615135cdbf73ef
AgentTesla
976a675d05bad332d53474456b0eb37c7f8560142894b979b52142a388584502
AgentTesla
ac22b41b8032e7b558fb97086308512b46828c3144fe9a2c8a4eb8987a9c3ca9
AgentTesla
c1869d79f9a68684a0cdf7c9c0a4a6315b16c1ca377e9ee98ccb452268398a26
AgentTesla
d31167b693b3e77f4aaf085c05db93ef82925c377fe5f801aca45a9990c735e9
AgentTesla
e7e6495235a14e61ab7b908744eafbc15d813b74be113b33bf70f1ffc010468f
AgentTesla
ea1f0cc9f1ed750600f0868ef8e52edc38ad36dae0d15af99de11af3176d3487
AgentTesla
ecc1fd1b10f173ed89edb0288c945642d67c2e19a70f8f12775361cfccb4c641
AgentTesla
+ 8'068 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210809-nbnrwdj2jx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
20c220c4efae0148feecfc4d7214e6d3c513309edfc68a538afd319a18952f20
MD5 hash:
bd6ac07e9030318d98fac8e5e85eb0ca
SHA1 hash:
fe88d43368a708a8dae4724ca3f459eb4986bd54
Link:
https://www.unpac.me/results/da01693d-f4bb-42fa-909d-1ade2d60c07a/
SH256 hash:
aed00f82f1772e5a403cce9c1349202c8371e67ed9ef19a33cac0bf2a411f3c1
MD5 hash:
c273f926e2a29bd62cc8f27b569a0b2a
SHA1 hash:
e08d302cab3e11d776599a6b0537207fce6f9c51
Link:
https://www.unpac.me/results/da01693d-f4bb-42fa-909d-1ade2d60c07a/
SH256 hash:
d63772ae8ce192d7ff76a18b340af8743d403cd3f40dc0af23b2490e16699b48
MD5 hash:
bf894393208fc32ac27495b4cb9b28b7
SHA1 hash:
587ac4a8b2d193211a67fe0eb9f971068b30aef7
Link:
https://www.unpac.me/results/da01693d-f4bb-42fa-909d-1ade2d60c07a/
SH256 hash:
e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13
MD5 hash:
a719cd4c4453d777428de8038805b297
SHA1 hash:
61b5d2000396d2633759aaea4e97f85e9c5ed606
Link:
https://www.unpac.me/results/da01693d-f4bb-42fa-909d-1ade2d60c07a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe e153d211aa233e4bf94497348b24a79170513541f2b8799fbff866c968b8ea13

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1518231/
Cape
Cape
https://www.capesandbox.com/analysis/177447/

Comments


Avatar
zbet commented on 2021-08-09 06:06:56 UTC

url : hxxp://bante.xyz/saveme/sam.exe