MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b
SHA3-384 hash: f003fa6982f7043c9ebd95aff8c84a6b3c323ee61f727ed02736b20909be2d691df799e2d20e687b13e18f0ba3302ea3
SHA1 hash: 347821a7e2a21cfda3acf6a64e47fe63cc578f84
MD5 hash: f9fcfba027415d0ae1b474fa5d43e4b8
humanhash: moon-mountain-edward-autumn
File name:CONTRACT DOCUMENTS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'137'152 bytes
First seen:2021-09-20 07:21:42 UTC
Last seen:2021-09-20 14:44:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:5pP/haK73BfA8aHNO0zJQjYpVtEpgKsCcvZQDZQShuP9+LjI:5pP/QKTdaHNO4OjYprKDgZWVhY+H
Threatray 10'000 similar samples on MalwareBazaar
TLSH T1C435DD294D2682F7C7EEC62CD09C0FCEEB62A4837B918F1ED89187D6065770BE58845D
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CONTRACT DOCUMENTS.exe
Verdict:
Malicious activity
Analysis date:
2021-09-20 07:24:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f613da0b-7a9c-4088-8c6c-55ad5f86c4e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189243/
Detection(s):
SecuriteInfo.com.ArtemisF9FCFBA02741.3929.19691.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Launching a process
Creating a file in the %temp% directory
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/673594e9-b0ac-4d3a-808c-39b7063cba2f
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/853796
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 486228 Sample: CONTRACT DOCUMENTS.exe Startdate: 20/09/2021 Architecture: WINDOWS Score: 100 18 Found malware configuration 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Yara detected AgentTesla 2->22 24 7 other signatures 2->24 6 CONTRACT DOCUMENTS.exe 3 2->6         started        process3 file4 16 C:\Users\user\...\CONTRACT DOCUMENTS.exe.log, ASCII 6->16 dropped 26 Injects a PE file into a foreign processes 6->26 10 CONTRACT DOCUMENTS.exe 2 6->10         started        12 CONTRACT DOCUMENTS.exe 6->12         started        14 CONTRACT DOCUMENTS.exe 6->14         started        signatures5 process6
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-20 06:28:51 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r3qhcfyjhpkjzo4yqglni4k7joc6rz2am4qwbkpwjcs5jvjdsfq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
175575bcd0d96914d2e856f266ddc75e0173867bc685e7743c8d1bf3aaa0eb43
AgentTesla
88263a8938955ebaa8edb9484f39876b5968c35a66cf9a8b8267e37ba7539900
AgentTesla
bdc7478c4ff690ee8de17fa7bd7340698e3e6ac2baabfe4df9fc84986f6644b1
AgentTesla
d9087e4e807ef2e3c826c69d1a2e3b334e482f2ae12fc94445f595a79f64a674
AgentTesla
+ 9'990 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210920-h68rqadce2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
3aede958c6d615d4eab2e743eead7c9ad5d3db7913f483c9dbd75c49f8cde420
MD5 hash:
64cf07424217b48c0214ed8ce94b4a59
SHA1 hash:
c3cca30bb7fadd1df6e7c407387fd2d6a324ddfd
Link:
https://www.unpac.me/results/90a9e546-2470-4377-a26f-d5a2cef5af7f/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/90a9e546-2470-4377-a26f-d5a2cef5af7f/
SH256 hash:
d6a96bac9f23667c75c0a0af5f65a029de0ad5e2742f2657ca06e270e4d730d5
MD5 hash:
8d71a8744db7989b5696e42f4cb4d093
SHA1 hash:
33136112100e1893058502c4e15576faf7aa9e10
Link:
https://www.unpac.me/results/90a9e546-2470-4377-a26f-d5a2cef5af7f/
SH256 hash:
e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b
MD5 hash:
f9fcfba027415d0ae1b474fa5d43e4b8
SHA1 hash:
347821a7e2a21cfda3acf6a64e47fe63cc578f84
Link:
https://www.unpac.me/results/90a9e546-2470-4377-a26f-d5a2cef5af7f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe e4770388b849dea4e5dcc40cb6a38afa5c2f473a03390b054fb2452ea6a91c8b

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/189243/

Comments