MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b
SHA3-384 hash: 14241b21cf13716cf155c831a00a0fc177308f53ae08a1c15d1e3f810112b1c897293abe2180e77e92cb6e8d30b72d97
SHA1 hash: bcf2db7d385930aafaa0e4f0314eb7802676e404
MD5 hash: c73189edb58b4b5a530d6465bdf400fe
humanhash: eight-cola-william-oklahoma
File name:c73189edb58b4b5a530d6465bdf400fe.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'014'272 bytes
First seen:2021-09-06 06:28:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:6JmWMzH+hB/pzxJi3X3+b6umJBDARbeqTJgs3uGCmcClnxfhhhiAp8:aLpXk+b6umJBDAJeqtgmFCmTTff0AS
Threatray 9'623 similar samples on MalwareBazaar
TLSH T10C25051326BCCAE5F59E3E74907017009AB9AC465675E24BD80FBCEAD8B3743C9117E2
dhash icon 31b09c969698b033 (55 x AgentTesla, 27 x AveMariaRAT, 15 x Formbook)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c73189edb58b4b5a530d6465bdf400fe.exe
Verdict:
Malicious activity
Analysis date:
2021-09-06 06:33:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2dd6d8f0-ca1a-4c78-b44c-bd8d772a80fd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185530/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.UR.genEldorado.32630.23018.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
DNS request
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a99f2d9-d15a-4608-8da8-9776a7bbd422
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/845742
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses powershell Test-Connection to delay payload execution;
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 478170 Sample: nda5m3hRzs.exe Startdate: 06/09/2021 Architecture: WINDOWS Score: 100 40 youtube.com 2->40 42 outlook.com 2->42 44 2 other IPs or domains 2->44 60 Found malware configuration 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected AgentTesla 2->64 66 3 other signatures 2->66 8 nda5m3hRzs.exe 6 2->8         started        signatures3 process4 file5 34 C:\Users\user\AppData\...\nda5m3hRzs.exe, PE32 8->34 dropped 36 C:\Users\...\nda5m3hRzs.exe:Zone.Identifier, ASCII 8->36 dropped 38 C:\Users\user\AppData\...\nda5m3hRzs.exe.log, ASCII 8->38 dropped 68 Writes to foreign memory regions 8->68 70 Uses powershell Test-Connection to delay payload execution; 8->70 72 Injects a PE file into a foreign processes 8->72 12 nda5m3hRzs.exe 8->12         started        16 powershell.exe 18 8->16         started        18 powershell.exe 19 8->18         started        20 4 other processes 8->20 signatures6 process7 dnsIp8 46 api.telegram.org 149.154.167.220, 443, 49722 TELEGRAMRU United Kingdom 12->46 74 Multi AV Scanner detection for dropped file 12->74 76 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 12->76 78 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 12->78 80 4 other signatures 12->80 48 192.168.2.1 unknown unknown 16->48 50 facebook.com 16->50 22 conhost.exe 16->22         started        52 youtube.com 18->52 24 conhost.exe 18->24         started        54 outlook.com 20->54 56 google.com 20->56 58 google.com 20->58 26 conhost.exe 20->26         started        28 conhost.exe 20->28         started        30 conhost.exe 20->30         started        32 conhost.exe 20->32         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2021-09-06 06:29:17 UTC
AV detection:
11 of 42 (26.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5d26u7cnz4oc5x7o34yp6rspacnmxfzx2sce6g4elx5zzrp2xgnq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2ccaa6433590b5f135f49de557167dd9bae9e2a80f5550a6379da77e336a0296
AgentTesla
4ac759bb7e52f2f0f4839c3d3906406d3bc81895cd90a0425590ec67e8cc09d9
AgentTesla
4b029f971c1570391aab11270a01357771fbaf2464801b7c0e5a471853bd0f42
AgentTesla
b59c1cae2b7d87b625d60313e2f308ffa1d7fe712581f34936ac2f3566d16f80
AgentTesla
c186924c9e23f60e9dea580f9d3435d36a24c95fc2e4b79c95933cf870650697
AgentTesla
cf3f60295611af5ef3e9c80a9ab1a09928431a8c4a1561f7139267db480e05cc
AgentTesla
+ 9'613 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210906-g8x8bsaee3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1846829589:AAHSsEDTKvDOQ17YrNRY5_FXv5z4mpfGRIc/sendDocument
Unpacked files
SH256 hash:
d0f9318816d139752e4fcd109fdbd5e4c46cf397f1a5b4d291ce0f3a356411af
MD5 hash:
509420444aa6c062d9b75207446f1495
SHA1 hash:
a2c82cde0843a1c1a52a3a89fe73576cf2cbb647
Link:
https://www.unpac.me/results/177510b9-aee7-4a6c-9604-c8171dbf7203/
SH256 hash:
02dc629d04cd36b744f48ab9c70d2eebef04a7031ac450628e7e8c4b4adca6ae
MD5 hash:
703f3075d398d961f951870d9d74f080
SHA1 hash:
93958c3d35645f92c4c5fc6989370979e4760e08
Link:
https://www.unpac.me/results/177510b9-aee7-4a6c-9604-c8171dbf7203/
SH256 hash:
4ac759bb7e52f2f0f4839c3d3906406d3bc81895cd90a0425590ec67e8cc09d9
MD5 hash:
59d161caba9a60785d14b3f05eb7c681
SHA1 hash:
27977c29daff707c4aa34277060135b181b42ab5
Link:
https://www.unpac.me/results/177510b9-aee7-4a6c-9604-c8171dbf7203/
SH256 hash:
e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b
MD5 hash:
c73189edb58b4b5a530d6465bdf400fe
SHA1 hash:
bcf2db7d385930aafaa0e4f0314eb7802676e404
Link:
https://www.unpac.me/results/177510b9-aee7-4a6c-9604-c8171dbf7203/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e8f5ea7c4dcf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Telegram_Exfiltration_Via_Api
Create hunting rule
Author:lsepaolo
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe e8f5ea7c4dcf1c2edfeedf30ff464f009acb9737d4844f1b845dfb9cc5fab99b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1411476/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/185530/

Comments