MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e
SHA3-384 hash: ac6f468bafd4426aa53670da518d20553c4300a7b158b9cf23e8f6aec07861bcfbd0b2228bf90b436dc32f6a7be1df83
SHA1 hash: ba5feb4167362ef7653ee2b37e0bade427ed8786
MD5 hash: 6468a151622f24089ebf3baa10a8287c
humanhash: yankee-cat-seven-illinois
File name:PickUp Notice_HKGB88932410.xls.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:590'848 bytes
First seen:2021-08-05 12:59:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:L41ijDCGvBowm8sokmuSmxH4mp4U4x56MA6JrFerea+ezRmFij+mYGAoatGcbtbW:LvCsB/m19WjA+0ea7zDSqAo6GmtbwrJ
Threatray 7'874 similar samples on MalwareBazaar
TLSH T1D3C4AD6176DA0A4BE47DC3799044903D92E3BF65AB50C20E7B8136C9E9BDB053AE53C3
dhash icon 8f43484c4c4a418f (10 x AgentTesla, 1 x Formbook)
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PickUp Notice_HKGB88932410.xls.exe
Verdict:
Malicious activity
Analysis date:
2021-08-05 13:03:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/88692a4b-2748-482e-b549-a404f169abc8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176649/
Detection(s):
Win.Dropper.Nanocore-9831995-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/943ccf0d-5071-45a8-9c20-25835b671962
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/827602
Signature
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 460035 Sample: PickUp Notice_HKGB88932410.... Startdate: 05/08/2021 Architecture: WINDOWS Score: 100 28 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->28 30 Found malware configuration 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 7 other signatures 2->34 6 PickUp Notice_HKGB88932410.xls.exe 3 2->6         started        9 winfiles.exe 3 2->9         started        12 winfiles.exe 2 2->12         started        process3 file4 22 C:\...\PickUp Notice_HKGB88932410.xls.exe.log, ASCII 6->22 dropped 14 PickUp Notice_HKGB88932410.xls.exe 2 5 6->14         started        36 Multi AV Scanner detection for dropped file 9->36 38 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 9->38 40 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 9->40 18 winfiles.exe 9->18         started        20 winfiles.exe 2 12->20         started        signatures5 process6 file7 24 C:\Users\user\AppData\...\winfiles.exe, PE32 14->24 dropped 26 C:\Users\...\winfiles.exe:Zone.Identifier, ASCII 14->26 dropped 42 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->42 44 Tries to steal Mail credentials (via file access) 14->44 46 Tries to harvest and steal ftp login credentials 14->46 48 2 other signatures 14->48 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-08-04 21:45:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
76
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4qz3htevf7wafgcltu3hrk3r7hqwrjlbmvipitt2woyfjdib5uxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19d68395856d55d691fb6c138992115862c5b3ab6902d828dfc0f3719cf7c4fc
AgentTesla
1f57778e5448ce6d8834f523299fc5ba868636556c993a4b5f3faabacb36c993
AgentTesla
359de4e28b1286f601c3d8cc5987ff8f81335f049411f00d99496c2f56bbade0
AgentTesla
9fcdd20c1848723a889fd4ebb88e52a2cb9fae8ec9e8cfe70d8e9706ef3e8992
AgentTesla
b12e0f709745dc5781e1345b925233d223f475055ee0e179e2164f98796f3046
AgentTesla
c036d17dfba3abc15188b34727f219b99f9471752d565bc8bfbe2ef6c07aec80
AgentTesla
d47da005885b968328d25d493a11e0fe3a146c9103f24b0de735a02b117c6a4b
AgentTesla
e860f949006657d88539f009376c3b6ed3947e81ddd1dcc2253f0c27b1945806
AgentTesla
+ 7'864 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210805-qc163sxe5e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
a5f47f5c53b0866d50941ea45fa4029fb4dd99670a0d9d096fc72eb7dd9b8e21
MD5 hash:
9737cf7b9ef9dfe0926bd2c79ba29734
SHA1 hash:
6fe6044e051bf3ea7a468ee7c09f843f78d0fc69
Link:
https://www.unpac.me/results/d54fc7ff-a624-4e53-b8ef-a3061a90f513/
SH256 hash:
b816d7ebcfbc8b8dede9c58d7b6fd7654701aca72ed4973384851bb6f36d320c
MD5 hash:
20fcde8c1bcdbfb182357b5d16574459
SHA1 hash:
5f38cd3d744e79e34ff6f3843d786878510c0a6f
Link:
https://www.unpac.me/results/d54fc7ff-a624-4e53-b8ef-a3061a90f513/
SH256 hash:
e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e
MD5 hash:
6468a151622f24089ebf3baa10a8287c
SHA1 hash:
ba5feb4167362ef7653ee2b37e0bade427ed8786
Link:
https://www.unpac.me/results/d54fc7ff-a624-4e53-b8ef-a3061a90f513/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/e433b3cc952fec02984b9d3678ab71f9e168a5616550f44e7ab3b0548d01ed2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/176649/

Comments