MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c
SHA3-384 hash: 4dc5827ed7afad50601a5e7d2f28a18791374c11cc47923fe266913183a38e312fe107ee5cc2ef40b07ae2bfac3e3ec0
SHA1 hash: f1c903b2b4d18b081f129e043e181298ba24cb6d
MD5 hash: 5d196b27ef9cbcb777a735f4c67fc14d
humanhash: undress-summer-louisiana-michigan
File name:SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'622'528 bytes
First seen:2021-06-03 06:13:35 UTC
Last seen:2021-06-03 06:54:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 24576:jtGs2MTWjAHHzU7NdOnPPlYrntk5OVny2mY1gF3HJaHYe+D/:ZGsujAzGOnPPKrntyFbzpte+
Threatray 124 similar samples on MalwareBazaar
TLSH DA75E8B2B591BFA4E32986738DDF586D87BD42FA17013F394F734988EE223538518846
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SOA.exe
Verdict:
Malicious activity
Analysis date:
2021-06-03 06:19:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6a4be8ef-6246-4d8b-91b2-d8098e03d515

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/164274/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/796447
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 428843 Sample: SOA.exe Startdate: 03/06/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Multi AV Scanner detection for dropped file 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 7 other signatures 2->59 7 SOA.exe 7 2->7         started        11 newapp.exe 5 2->11         started        13 newapp.exe 2 2->13         started        process3 file4 35 C:\Users\user\AppData\...\CfvktrYbooRseT.exe, PE32 7->35 dropped 37 C:\...\CfvktrYbooRseT.exe:Zone.Identifier, ASCII 7->37 dropped 39 C:\Users\user\AppData\Local\Temp\tmpBB2.tmp, XML 7->39 dropped 41 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 7->41 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->61 63 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->63 65 Uses schtasks.exe or at.exe to add and modify task schedules 7->65 15 SOA.exe 2 5 7->15         started        19 schtasks.exe 1 7->19         started        21 SOA.exe 7->21         started        23 SOA.exe 7->23         started        67 Multi AV Scanner detection for dropped file 11->67 69 Machine Learning detection for dropped file 11->69 25 schtasks.exe 1 11->25         started        27 newapp.exe 2 11->27         started        29 newapp.exe 11->29         started        signatures5 process6 file7 43 C:\Users\user\AppData\Roaming\...\newapp.exe, PE32 15->43 dropped 45 C:\Users\user\...\newapp.exe:Zone.Identifier, ASCII 15->45 dropped 47 Tries to steal Mail credentials (via file access) 15->47 49 Tries to harvest and steal browser information (history, passwords, etc) 15->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->51 31 conhost.exe 19->31         started        33 conhost.exe 25->33         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-06-03 01:31:42 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4vw7dog5tsa6pznx355pvpuh4la3447n46kd7uh2qrpeh4b7jfwa._file
Verdict:
unknown
Similar samples:
04826eeb4d21104190dfb002657c616a669577a5a5a16da88ff50402faafa25e
AgentTesla
21c9d551916ce07bc434b9f1dfa8aaa4cd47c2746a0ece6f8ea1f2b61083d168
AgentTesla
2a7bafae032f032eaaa5572bfc620b8ad777e9936932c0dc01464a4392429ad2
AgentTesla
37211ea70920adce4d2704187d8f45233724e84c2dc18158387da8bf2e94eee0
AgentTesla
3a433d9d40efde586b6da1409014e23c3c08a668f3148682524406f852e239af
AgentTesla
6f7ceadb0d2fed6b1c7fed3f479dad5a0e6e91263ae9fb0d5d97b811c1fb90c4
AgentTesla
a7116dc8a8296b97287b628c8cc8cc5fd834557d6d0fc29d5944fd1e4a30b8a3
AgentTesla
afabee3b75e9306690817b4481a2bea7da115da9e34d1da2afeba4df263adecb
AgentTesla
b1c2eb2fe7296e6138b720e8afd126b79ee03f5202065473ca1bb1779a4050bc
AgentTesla
c8154fc702b6d57a98a25576319480aed8b53e991dd1460c04556b8dddc89ae2
AgentTesla
+ 114 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210603-skw77mg8qe/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
1e7c66f6da06a0ea81371fb98d0e76424a600518b808140279c7ba8e06541ac5
MD5 hash:
8fe0389e4b903545421e42b628186cd2
SHA1 hash:
f6adc3d1a4ac995fad2a49474243d896b0236c2b
Link:
https://www.unpac.me/results/8b3c1c2d-8900-4001-b8ec-3fd29c48e965/
SH256 hash:
e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c
MD5 hash:
5d196b27ef9cbcb777a735f4c67fc14d
SHA1 hash:
f1c903b2b4d18b081f129e043e181298ba24cb6d
Link:
https://www.unpac.me/results/8b3c1c2d-8900-4001-b8ec-3fd29c48e965/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe e56df1b8dd9c81e7e5b7df7afabe87e2c1be73ede7943fd0fa845e43f03f496c

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/164274/

Comments