MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eed9c06050ec45f480528543bba5e3176158763beda21f62220bde77f0bdeb3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	eed9c06050ec45f480528543bba5e3176158763beda21f62220bde77f0bdeb3e
SHA3-384 hash:	bfd6da9f85d9376a9f7ccf7ce650599d3c46654137b780973b53d4f1e8544c8a4b4af4ee1acdfc2b772c8d73e7dc0fcd
SHA1 hash:	dd2e92cf2d7f9fbc603c41e8c372f6b6333ff7e6
MD5 hash:	04ebe2a4eab545157e25f7c750db1710
humanhash:	nevada-zebra-fish-blue
File name:	proforma invoice.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	713'216 bytes
First seen:	2020-11-26 10:31:05 UTC
Last seen:	2020-11-27 06:48:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:F4Iw1qjxrd2y87Db2bxMFsbAhsYbQQMkdSHHCkY1qN9+0CbU5zPvE:F4I/rduY9bAhsXkdY0SJCA5LvE
Threatray	1'522 similar samples on MalwareBazaar
TLSH	9AE45B23335C87ECDB683FF4A43101BF36A5EA11826DF66CDEE6CC874B5249416B6681
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

143

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/105730/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/548067

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/eed9c06050ec45f480528543bba5e3176158763beda21f62220bde77f0bdeb3e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-26 10:32:15 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=53m4aycq5rc7jacsqvb3xjpdc5qvq5r35wrb6yrcbpphp4f55m7a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c

AgentTesla

60263179eccb843c5aa38040ebd2483b29a3923a94987f006561488e5d0f1d96

AgentTesla

841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb

AgentTesla

87fde2e49507d58cdcc464c5d3e36d322c7f77a4f9e5cc0f1a46455f1a67df5c

AgentTesla

9c7002e97c59c4c190abb09e373a5f1010b4790dbcb714e792538e73820d5609

AgentTesla

b2b25365ac3fab2649ba188a0c113a558686c049d89bb4b8f3d7439a6e6732c0

AgentTesla

bcba47ff7460e3a03098516dcc1af9369b8fcc302fefaa07c57024830f57e93c

AgentTesla

cc2cc617d2d0f4b909be15f9720cdd9bdeade5fafe2b0c02eee852b15d33d366

AgentTesla

ecf592d2aed1d17b4c75e72a40edeb9b4396c8c9181cee7519ebe63bb7391870

AgentTesla

+ 1'512 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201126-pqpsxmlz82/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

a3a008b87ded765ed76c9bedd06dbae5f62edd573da15d376cb3fb91b4bd7f09

MD5 hash:

5ae25f51e2881f74cc9e057ef48c02a6

SHA1 hash:

a8e9e48e0e788e76ce01e923946bfb0c2098b39c

Link:

https://www.unpac.me/results/d714f289-59b6-40c7-94ed-339161d909d9/

SH256 hash:

58e284ca7edbdbe720c6aca3593d614360cb8161bf67b239939a0e631fc76f28

MD5 hash:

703af4c3462279c96105e81fab40b201

SHA1 hash:

3a901602ea0307daa882b933f7f1a01cfc8074ab

Link:

https://www.unpac.me/results/d714f289-59b6-40c7-94ed-339161d909d9/

SH256 hash:

fe2b7e21dde5765c8ef741aa52991cafc9c1b47f1869aa7cf71debf020519d3d

MD5 hash:

998d6a14ba9c871155d8d93357e072ea

SHA1 hash:

0dd113de64bf4c911211ef26e10e87546943d164

Link:

https://www.unpac.me/results/d714f289-59b6-40c7-94ed-339161d909d9/

SH256 hash:

8c8e096c301a8697b4b96fd4b05a409096fcc861f0f59f04979c0419dec70c5f

MD5 hash:

36dd1e5cd9709af528d8738ece88cff8

SHA1 hash:

047c81e75dc841df0a72314bea9d16abcc6587b4

Link:

https://www.unpac.me/results/d714f289-59b6-40c7-94ed-339161d909d9/

SH256 hash:

eed9c06050ec45f480528543bba5e3176158763beda21f62220bde77f0bdeb3e

MD5 hash:

04ebe2a4eab545157e25f7c750db1710

SHA1 hash:

dd2e92cf2d7f9fbc603c41e8c372f6b6333ff7e6

Link:

https://www.unpac.me/results/d714f289-59b6-40c7-94ed-339161d909d9/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.