MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1
SHA3-384 hash: 31b9979f6b26a2b57be44ec3ba320c6ddfe78bec14cae1f72c0463e1b86011c1c57f820e2529d920b4b8ea5bbe86a359
SHA1 hash: 8f55251fc7a4685cc463d6cbd13b33ef00d6106e
MD5 hash: bdff43b1c284e348602cf2a7c6a0e2fe
humanhash: may-uranus-thirteen-pluto
File name:Invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'010'176 bytes
First seen:2021-10-14 08:05:26 UTC
Last seen:2021-10-14 08:51:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:8afHWPflh5tWxLwlNVmZZDP3vcJNRdhf57fX4CweNqmCeUhkvkJ5d1O:8aHwh5tywDVm3P/0Nhh7fX46op1R
Threatray 11'780 similar samples on MalwareBazaar
TLSH T11F25F815F3429C02E46B527360E450E392546887E998837DEBB3BAE31C9A7C04F5DBDE
File icon (PE):PE icon
dhash icon e0b292aa9adab2b0 (8 x AgentTesla, 1 x RemcosRAT)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Invoice.exe
Verdict:
Malicious activity
Analysis date:
2021-10-14 08:09:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/302c858f-4d24-4dcc-830b-2fd719e6fbf6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/197446/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.44008.2693.24099.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool obfuscated packed
Link:
https://www.filescan.io/uploads/6167e4f1fd35fe780c3f751b/reports/ec3988c1-63db-420a-a57f-8de0e0f29099/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d22ee435-2202-4e4e-b9e2-70a2f9c0b090
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/870268
Signature
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502696 Sample: Invoice.exe Startdate: 14/10/2021 Architecture: WINDOWS Score: 100 38 mail.adityagroup.co 2->38 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Found malware configuration 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 4 other signatures 2->54 8 Invoice.exe 6 2->8         started        12 tKZVPq.exe 2 2->12         started        14 tKZVPq.exe 1 2->14         started        signatures3 process4 file5 32 C:\Users\user\AppData\Roaming\LQkhtZGHV.exe, PE32 8->32 dropped 34 C:\Users\user\AppData\Local\...\tmp389A.tmp, XML 8->34 dropped 36 C:\Users\user\AppData\...\Invoice.exe.log, ASCII 8->36 dropped 56 Uses schtasks.exe or at.exe to add and modify task schedules 8->56 58 Writes to foreign memory regions 8->58 60 Injects a PE file into a foreign processes 8->60 16 RegSvcs.exe 2 4 8->16         started        20 schtasks.exe 1 8->20         started        22 conhost.exe 12->22         started        24 conhost.exe 14->24         started        signatures6 process7 file8 28 C:\Users\user\AppData\Roaming\...\tKZVPq.exe, PE32 16->28 dropped 30 C:\Windows\System32\drivers\etc\hosts, ASCII 16->30 dropped 40 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->40 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 16->42 44 Tries to steal Mail credentials (via file access) 16->44 46 5 other signatures 16->46 26 conhost.exe 20->26         started        signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-14 06:00:53 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=52rrgolwpewmh7iskrlw5fx7an5hhxuww2gkeb3h2cc65qt2etyq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08caa9af8bc3d72fc768962c2319b86c9712a2437e6ca0e7cca8fc1049536def
AgentTesla
6207ef2afeb35589b4c9f58ac7557ffb9670c81376f436b149ad8ca45a7630f7
AgentTesla
6c774012ef6641580ad729f00e565e5ab5a13e7eeca97b510f2e2e9e101b9375
AgentTesla
71e6c949b0e259018b39ad513305c9197afe74c9d68119db8e6e545c74ceedcb
AgentTesla
790b008421852f555794a5e59c91f894993dcac641104ca06087bda8c1b5ea50
AgentTesla
9664d7052873349992d586788296c16579941a802a41b70afdc08867b2153d65
AgentTesla
b8e4c54f15ac8fc84223e2460f6201401c960851b4006d61360caa57c34af3ed
AgentTesla
d375f6f780b9623c85714c9fadae46359a8e308bdeaee7e2161a86c0a89c7d06
AgentTesla
f39980b6f513345fde2aad18cb790595c8cb64139cb0aa1686d6c4e7c8b24e2b
AgentTesla
f3e6dcfd4b79c28078de10a6e14385b58a69b73b79986cef7000e88501b7d3ae
AgentTesla
+ 11'770 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211014-jzfyssgfb9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
a3b11e154dee84872207d5486f807206eeb79983ec9583ec01cd621ae2074331
MD5 hash:
dafd94ed69fad3b15882f92b4bac9a42
SHA1 hash:
9618ad6fd789c96182da093340c17a8be09916d6
Link:
https://www.unpac.me/results/119e4081-51e3-48b2-b8b3-c8a26f8a6471/
SH256 hash:
b44c761ce8089133b3d09629d773aba0a30743444b8bcbcd5eef117ca16d681b
MD5 hash:
53a21251956f0c782b91d0736deed2a8
SHA1 hash:
739da17a72947aa416791bd42a5bc8afa3f7db57
Link:
https://www.unpac.me/results/119e4081-51e3-48b2-b8b3-c8a26f8a6471/
SH256 hash:
43e38f251dbca9aa20f3470167e5427a7e7a7cdcd25f0b6b045ae8577cd3e345
MD5 hash:
f62ab5d3528d5a3b9e270ea1f9347868
SHA1 hash:
6a74e87711c615adbd9145f829a33f55b7e42dd6
Link:
https://www.unpac.me/results/119e4081-51e3-48b2-b8b3-c8a26f8a6471/
SH256 hash:
eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1
MD5 hash:
bdff43b1c284e348602cf2a7c6a0e2fe
SHA1 hash:
8f55251fc7a4685cc463d6cbd13b33ef00d6106e
Link:
https://www.unpac.me/results/119e4081-51e3-48b2-b8b3-c8a26f8a6471/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/eea313397679/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe eea3133976792cc3fd1254576e96ff037a73de96b68ca20767d085eec27a24f1

(this sample)

  
Dropped by
agenttesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/197446/

Comments