MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e866824950770040716cf1a23d39a4e814247e132ad912845c50b05dd0cab213. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e866824950770040716cf1a23d39a4e814247e132ad912845c50b05dd0cab213
SHA3-384 hash: 1aa025a045e07fbb756925456437b8ca38bb759c7cb961427718ed0a4648e32611912bbc1490470a893fe304f1a9c385
SHA1 hash: b0c80a1442364b771798318b3c353f24925b05db
MD5 hash: ef983fba6c4b0b58c1b074ab9416b201
humanhash: carpet-apart-east-harry
File name:Pedido De Cotacao.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:555'520 bytes
First seen:2022-01-31 12:12:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:60NVO7JW3pR4d8va+8uYfrnt5ApAMjDw4s18eO9apZ3p:6QVOVwRYN+HYfLt6i4DwROg7
Threatray 14'790 similar samples on MalwareBazaar
TLSH T119C4BEB4A0A74691F10BC974247CF96102B231E3B9C60D3427793645DFAEFA93F85A4E
File icon (PE):PE icon
dhash icon 8cfcd89cccc8d0b0 (23 x AgentTesla, 14 x Formbook, 4 x SnakeKeylogger)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/228416/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Сreating synchronization primitives
Unauthorized injection to a recently created process
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61f7d254d9e6538232d75674/reports/50f89b22-39f2-41a4-a686-ec6d5f03a0d5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/614d833d-feca-4da2-a60c-ff39213f0127
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/930821
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e866824950770040716cf1a23d39a4e814247e132ad912845c50b05dd0cab213/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 12:13:14 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5btieskqo4aea4lm6grd2one5akci7qtflmrfbc4kcyf3ugkwijq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
03a5f02e2510ecf8b8990cd651cc7085e057555e8be3415e48167e73ae3aeb40
AgentTesla
116f41d0a34e2260753d6371c978dbe5b8f287ae78824c6c3c95b7d8a372df7c
AgentTesla
1b9bb1e946bfa8aedec8483a97b8abc7bac0da1e58150d23b2c0473aa1095782
AgentTesla
600cabadb76748d432bfd5f442190a3a839310407e2f3b817b23c78c2b75ff55
AgentTesla
7d330e99d8984003178e9901572adc43d719d4618aaa076a8e697eada127c014
AgentTesla
c2aeeb2423bbb32caf5763f566bc597227a286b9f55976edfa99b90e379e938c
AgentTesla
c93e913c5dd5c8371f2acb548cf3761cec09e76c5b37b3cb36163142ccc45b5b
AgentTesla
de2e00592af25f6033e0b10dbf2974b1e482ad117118cb726892a89acf2cd47b
AgentTesla
+ 14'780 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220131-pdrq3ahbar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ba6a4d8c70397417821d02570ea4c9e7e9d8b6064e9bf8dc14b3b3fbd6819260
MD5 hash:
5abe6c49a7beca2bd0c2aa0354d96e4c
SHA1 hash:
f190e331ca27ff205017eb47242e03e4365dfe50
Link:
https://www.unpac.me/results/fcd7dfa1-a50f-497d-8a45-5f26ddceb219/
SH256 hash:
6f1b89bc3013177c101fe4448340c48c0dd08d19017a798bd11c2d0f76be1fbc
MD5 hash:
60a604887b3616e3ed86d81fab0a9ebb
SHA1 hash:
8db84f5f4c569c86c69aff464b2ffc4ce3dafa20
Link:
https://www.unpac.me/results/fcd7dfa1-a50f-497d-8a45-5f26ddceb219/
SH256 hash:
357fcdb6c8c01e063b77c902daacdba74d3b314148c53b960d642f0b1d7c53fc
MD5 hash:
e7dafb960f036070d21a46e06eb31be0
SHA1 hash:
6f1615e8841cf6e10fd4a9ac54da6a5fca3f1a65
Link:
https://www.unpac.me/results/fcd7dfa1-a50f-497d-8a45-5f26ddceb219/
SH256 hash:
e866824950770040716cf1a23d39a4e814247e132ad912845c50b05dd0cab213
MD5 hash:
ef983fba6c4b0b58c1b074ab9416b201
SHA1 hash:
b0c80a1442364b771798318b3c353f24925b05db
Link:
https://www.unpac.me/results/fcd7dfa1-a50f-497d-8a45-5f26ddceb219/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e86682495077/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/e866824950770040716cf1a23d39a4e814247e132ad912845c50b05dd0cab213

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/228416/

Comments