MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd
SHA3-384 hash: 024b399b37ce181664885da3cb9af9e86e06576f7f0bedf2bd80e2e691f113cd613833670610e671b6c7262fab7f4afb
SHA1 hash: 357c26df784166b0d5ccfed3b1f70b02cfd0e0ed
MD5 hash: d22c292d29cfcbaec59b6c0e441269d5
humanhash: failed-red-may-kansas
File name:new quotations pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:858'624 bytes
First seen:2021-07-13 12:54:36 UTC
Last seen:2021-07-14 07:20:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:Wt8FF5px4mI0Ae9Km6MQrOINgI4GyDYeQtE271eHl:DFBx4m8nVrO+gI4GykXW2ZeF
Threatray 6'657 similar samples on MalwareBazaar
TLSH T16805D07A57DD0627DBBE92B536A0F006F760AC933A21DE0F42C37186253778129D2D6E
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
new quotations pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-07-13 14:43:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/83e59b0c-be67-4388-8bff-615fcf968233

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171390/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.5506.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/185e768c-e336-4c41-8ac0-03fd4466a5f0
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/815688
Signature
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 448099 Sample: new quotations pdf.exe Startdate: 13/07/2021 Architecture: WINDOWS Score: 100 24 Found malware configuration 2->24 26 Multi AV Scanner detection for dropped file 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 11 other signatures 2->30 7 new quotations pdf.exe 6 2->7         started        process3 file4 18 C:\Users\user\AppData\...\rjCJbOOaAll.exe, PE32 7->18 dropped 20 C:\Users\user\AppData\Local\...\tmpBF97.tmp, XML 7->20 dropped 22 C:\Users\user\...\new quotations pdf.exe.log, ASCII 7->22 dropped 10 schtasks.exe 1 7->10         started        12 new quotations pdf.exe 2 7->12         started        14 new quotations pdf.exe 7->14         started        process5 process6 16 conhost.exe 10->16         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-13 01:23:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4neceexxk654dlgwg4tfqjs36ytmqgimgvbaqa7sh4la3thvpx6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05d2cc58039f7d736dcaea7fc43415966758d7befeabf4be9d15ec4f0bb4431e
AgentTesla
2d0a0929563c7b8c43b26d3291c512effc1fb6bec491b2ba0999dfd243eac3c0
AgentTesla
3c0f96d1494aede43b72738e22159ce87107bf430458d1e73813262a648017b4
AgentTesla
65311e0d5afc8166606e9db1371b113b630cc15d4c28d8324273caa1540e211b
AgentTesla
80229ebcf769df182c0354a82f076cb2f093d95a2bde0af3d9ef740c1aa038a6
AgentTesla
9392b47a6d8ba3302fa0d4a460a9a6582f87a8e983c69cdb0fff28d92a196c5a
AgentTesla
e0cfb9e16d1bd4989f318107c8716a001558a751d41b60a04fda471dd4fcbf53
AgentTesla
ea08fc031bc184b29f528ea6f2d34a8e8537356cb2b36826c653d769674601b3
AgentTesla
+ 6'647 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210713-e83ch5y8z6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
94ac2f4666ca8a84d2a8cfd5fe7b3ee1129179fe1825714fbd3c4e580cb180c7
MD5 hash:
2c8e8777c498644a540c717e3a06f041
SHA1 hash:
eb450376662874e91048cc1dc89dbf7dd0eced46
Link:
https://www.unpac.me/results/ccbc50de-5f61-437b-87a0-ccaa03452d61/
SH256 hash:
c362729899c5956cfa9fc3bcf9b21ac72066a1b84a497ceb1281f76e2f55c54b
MD5 hash:
0327d1374a5ce015ad9c83c5de76e823
SHA1 hash:
e521349d9e96a4191248747c42c78b6f88fc8f63
Link:
https://www.unpac.me/results/ccbc50de-5f61-437b-87a0-ccaa03452d61/
SH256 hash:
937f06844e07b0afa1f92972c99e408b20f90ad8473f3f17b27a1886ed368762
MD5 hash:
cb937e4c69262259ae8a6860842c766c
SHA1 hash:
b5671569e0b96958c62fb0a487c743a8a2204212
Link:
https://www.unpac.me/results/ccbc50de-5f61-437b-87a0-ccaa03452d61/
SH256 hash:
e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd
MD5 hash:
d22c292d29cfcbaec59b6c0e441269d5
SHA1 hash:
357c26df784166b0d5ccfed3b1f70b02cfd0e0ed
Link:
https://www.unpac.me/results/ccbc50de-5f61-437b-87a0-ccaa03452d61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3482212f757bbc1acd6372658265bf626c8190c35420803f23f160dccf57dfd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/171390/

Comments