MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0
SHA3-384 hash: 1a2c35e51ea34b9c6aed88123ef581c6ed334d0a100feb37e9af620c482012ac31a6fb37e35550fda518223cdbe4a714
SHA1 hash: cdd8a929d8fb1d884959767896d8cb82973c1d4d
MD5 hash: ffdc0c9d0453f714bfc0b1d98141c21d
humanhash: magnesium-social-two-alpha
File name:Purchasing FOOD STUFF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:603'648 bytes
First seen:2021-07-18 07:07:39 UTC
Last seen:2021-07-18 07:44:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:2KuztJvB0kZq1ZRMKTxkUL2tvFbgGQXhSVR+b2Sq+0a9H9EeqmJU0:2KuztlB0kU3KExkULMbtQ6+bA+JB
Threatray 6'998 similar samples on MalwareBazaar
TLSH T1CED4F16933087B9FC43BD7794454491067E0A962E323E61BFCA760D95D4EBC68B332A3
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchasing FOOD STUFF.exe
Verdict:
Malicious activity
Analysis date:
2021-07-18 07:09:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a2367b4-e04f-46b0-b96d-ef96e13cc01e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172388/
Detection(s):
SecuriteInfo.com.Variant.MSILHeracles.21746.20169.12053.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ebff7c43-3754-4b84-bccf-a2c2ebe13caf
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817901
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Regsvr32 Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450312 Sample: Purchasing FOOD STUFF.exe Startdate: 18/07/2021 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 10 other signatures 2->39 7 Purchasing FOOD STUFF.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\...behaviorgraphIxVTvvWqR.exe, PE32 7->21 dropped 23 C:\Users\...behaviorgraphIxVTvvWqR.exe:Zone.Identifier, ASCII 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmpCB5D.tmp, XML 7->25 dropped 27 C:\Users\...\Purchasing FOOD STUFF.exe.log, ASCII 7->27 dropped 41 Injects a PE file into a foreign processes 7->41 11 Purchasing FOOD STUFF.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        17 Purchasing FOOD STUFF.exe 7->17         started        signatures5 process6 dnsIp7 29 scottbyscott.com 50.87.146.199, 49766, 587 UNIFIEDLAYER-AS-1US United States 11->29 31 mail.scottbyscott.com 11->31 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->43 45 Tries to steal Mail credentials (via file access) 11->45 47 Tries to harvest and steal ftp login credentials 11->47 49 Tries to harvest and steal browser information (history, passwords, etc) 11->49 19 conhost.exe 15->19         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-17 23:04:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mvb6idhijzctiydprzzctzks6f5hinla5dat7wvsyxjklnsupaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
25c6ed88a34e97a0d1c4c8fa3d2c90a6b39345a56f0dbf5775bb2e4d2320415f
AgentTesla
5c17ad97be2e3d64846a0150594f54a6fc033e68b511a0a2e7fa0469306745ec
AgentTesla
66bd41f42be4e3ef4d73b4d4c68c52c32dab1aea1e7e772c8e7ad6bf16e65331
AgentTesla
a151c4bd6df1aa4e94675c10e27a75dfdc56a22b150229b0a761bd3d2d9dbd10
AgentTesla
a261898485667823b47ab6885b0cd8c16d126bc0f1671dd7aeb9b675aa01aff0
AgentTesla
a72b5e537bb683e6f899eed4d01dc5651fd08444d2e652ca069565b388319b5f
AgentTesla
c8a8b43ec47c6c9831e275e2009ab58f7794374b4876fe72dbc4151296330aec
AgentTesla
f06c40df7dde44469aa47985010736dbd83224df91951b9d55cdb7a377353a61
AgentTesla
f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412
AgentTesla
+ 6'988 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210718-7pwv7l5sfj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
bc13f4f3a31503c28950f3ac9e01325a92014f84405e4c163d3c3e2bf3e839a5
MD5 hash:
f3553fc66fa0655005350c4e91e447b5
SHA1 hash:
d523ed167d7c09dbef2c443d5fd56e8c58be56ef
Link:
https://www.unpac.me/results/d2cfbd7e-5799-4618-9c38-f38e3191a401/
SH256 hash:
a4afd776d78f323a8de5ad97b4c4848d510ce36c68aea2972fc82ce5735315dd
MD5 hash:
56f0eb08635393c5052221a18b8e4488
SHA1 hash:
c5843e3abcdc6a25ca7e6dd42499bc7ebd8311af
Link:
https://www.unpac.me/results/d2cfbd7e-5799-4618-9c38-f38e3191a401/
SH256 hash:
42b2ce0439583c778c45ea6324a9b476fb0c40fb0d9cd99bccd8661f9834a9b2
MD5 hash:
659c6e0440395abdeac044b7aaf7338a
SHA1 hash:
12421b60f06cf8f1a9bbd812b35d0a05e6eb56d6
Link:
https://www.unpac.me/results/d2cfbd7e-5799-4618-9c38-f38e3191a401/
SH256 hash:
35681a53c101cc982671447c8fabe2d1337a2b1f056d6a243dc3cbc2f7d8c8a8
MD5 hash:
7a5999bf2197cd4e208e32e67e04bead
SHA1 hash:
0d406f0a277e1299b2bacfbba074726b052b2558
Link:
https://www.unpac.me/results/d2cfbd7e-5799-4618-9c38-f38e3191a401/
SH256 hash:
eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0
MD5 hash:
ffdc0c9d0453f714bfc0b1d98141c21d
SHA1 hash:
cdd8a929d8fb1d884959767896d8cb82973c1d4d
Link:
https://www.unpac.me/results/d2cfbd7e-5799-4618-9c38-f38e3191a401/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95

AgentTesla

Executable exe eb2a1f2067427229a3037c73914f2a978bd3a1ab074609fed5962e952db2a3c0

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 34643d67e03bf06a3a9bf6569049c9135548c4f61695a8f11eefa32f78111b95
Cape
Cape
https://www.capesandbox.com/analysis/172388/

Comments