MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a
SHA3-384 hash: 7558fc267021497f88eb3a8c96053097aabf94e28ae3c102e9e000e1bb2cb8f3469d97bcb5dd7207c97cb36adeeeea29
SHA1 hash: c8a54c1419192dbea4886c7e832a225c902b03c8
MD5 hash: f02a12ad0d9a60a9cae47004810125f0
humanhash: asparagus-green-carbon-eleven
File name:TT MT103_copy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:688'640 bytes
First seen:2021-09-03 08:20:45 UTC
Last seen:2021-09-05 10:06:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:T2oNGlbfZXgm+wAFwUi/sDEyumu+djBFz010Lm:T2ocbfr+wWwUi/6rdjc
Threatray 9'418 similar samples on MalwareBazaar
TLSH T133E42C3E59FE23279176C7D5CBE48923F6C498AF3233A96467D747264306A4634C322E
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
TT MT103_copy.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-03 06:32:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0a5be340-8e0b-4ac4-afde-35b8a9418bb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/185076/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.31988.10813.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e85b1d43-21a7-438b-bfae-fb5fa375bdd1
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/844639
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 477066 Sample: TT MT103_copy.exe Startdate: 03/09/2021 Architecture: WINDOWS Score: 100 39 Found malware configuration 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AgentTesla 2->43 45 7 other signatures 2->45 7 TT MT103_copy.exe 3 2->7         started        11 ZAYOk.exe 3 2->11         started        13 ZAYOk.exe 2 2->13         started        process3 file4 31 C:\Users\user\...\TT MT103_copy.exe.log, ASCII 7->31 dropped 47 Injects a PE file into a foreign processes 7->47 15 TT MT103_copy.exe 2 5 7->15         started        49 Multi AV Scanner detection for dropped file 11->49 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->51 53 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 11->53 19 ZAYOk.exe 2 11->19         started        21 ZAYOk.exe 11->21         started        23 ZAYOk.exe 13->23         started        signatures5 process6 file7 33 C:\Users\user\AppData\Roaming\...\ZAYOk.exe, PE32 15->33 dropped 35 C:\Users\user\...\ZAYOk.exe:Zone.Identifier, ASCII 15->35 dropped 37 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->37 25 WerFault.exe 23 9 15->25         started        27 WerFault.exe 19->27         started        29 WerFault.exe 23->29         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-03 07:57:52 UTC
AV detection:
9 of 43 (20.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yzxu75v2fl6re5zjnwdze5rixepaq756tvcxlflrx5lpq5tbqva._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3686959402c512154fc465117581958b97fa7c74657eb9909f31a6befb878e95
AgentTesla
56ce41513fcb85017d9b3cfa32c31dc6f50bf0886242aefd78bbfd91e1aaa303
AgentTesla
56e64a112104a4bceeec030a7a5a2b6ef64dee29f9acfd28ab55cb00f906fd26
AgentTesla
7353a3d45faaf458e6855490cc1972e8fae4b4fb3824e0931a963408754c4ea0
AgentTesla
7ed660effe5fdddebcf65d0340744f2d0642d00959a22f3023fa464e686532b4
AgentTesla
8aad37f11743588002ae17b9be7e92afe8389e29e3522d02b2541fcb0d18fbea
AgentTesla
d5f6325653a70427c44457dd2776d7c128d6590e921ebd2b4a9b62d46257e15e
AgentTesla
ddb27dedce37040816b06a70f6375dd10b5fc2f5dbc412ec42b8798fe4240ffa
AgentTesla
e2f4428edbba3c7a8e3389c968a1200c76289fd271f0469c436838d1d52194c1
AgentTesla
f3e6dcfd4b79c28078de10a6e14385b58a69b73b79986cef7000e88501b7d3ae
AgentTesla
+ 9'408 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210903-j811bscge3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
002f1870208f8ec63c5835032210ecfc7aec982fb857fe9a18879c3f8a6e2223
MD5 hash:
0d12988febbbdc97115eaff6b942a2fb
SHA1 hash:
e4433f2382c3ee077b9b2a51eb63d375e22d1ada
Link:
https://www.unpac.me/results/5c9b369b-d6a9-4d0a-a61f-1cce78633a4e/
SH256 hash:
758763d712c27c53a8b85de07582c9a250638b557e8dcfbae7c278f810241ac1
MD5 hash:
8b7d29dc138f646510a835ffc76e6796
SHA1 hash:
bff289517dc53acc9e172e3445fc87d82f8ee351
Link:
https://www.unpac.me/results/5c9b369b-d6a9-4d0a-a61f-1cce78633a4e/
SH256 hash:
c9b7cbdc6fee51c7fdd68a4c07bf392cb35a2f5866cd8c769960d98c8d234d54
MD5 hash:
c9954044aec4b9ccd903e770fdb396a7
SHA1 hash:
0d23986436a297473257e80812fcd6b13ba140bf
Link:
https://www.unpac.me/results/5c9b369b-d6a9-4d0a-a61f-1cce78633a4e/
SH256 hash:
e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a
MD5 hash:
f02a12ad0d9a60a9cae47004810125f0
SHA1 hash:
c8a54c1419192dbea4886c7e832a225c902b03c8
Link:
https://www.unpac.me/results/5c9b369b-d6a9-4d0a-a61f-1cce78633a4e/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e6337a7fb5d1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.54
Link:
https://yomi.yoroi.company/submissions/e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/185076/

Comments