MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26
SHA3-384 hash: 94113722d58c023959522c5a7ff677d2b30207ce6f63ee6d2145f866dddcce80e80952d7bfaaaa31a6903ae4ac215139
SHA1 hash: d08077aead71290edb549bb83e5e63c985997d37
MD5 hash: 8ace1f1be249dd3fa64f4a9a988979dc
humanhash: georgia-glucose-pip-bravo
File name:PROJECTTT.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'088 bytes
First seen:2020-09-30 16:46:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:4JZj3XBjlkq27zgxRUCqnc3RgKWBI3KGGWf7q7qdzG:QzZo7cvUnnc3RgzBI38zWd
Threatray 131 similar samples on MalwareBazaar
TLSH 55946CA736D1C87CC61D4672A4B981D0F97A66C63B614A0DB1AB431C0E02F9F6B13E5F
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67196/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a file
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/478579
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-30 02:22:02 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=64kjijc2bvjqjxv7rnacvoajmwjyspmbvw5l7ikubyat4dwjtyta._file
Verdict:
unknown
Similar samples:
0442367788ead3ccf0c9a36805053be48c332ab656f51667f4c08cbbfa3f3ac0
AgentTesla
48a35cf9fca5b44c11cf88bd2bde282b4bb0311eaccb8e7b0a6b60882ea08e95
AgentTesla
80f341333728513fea45dc07c8582e5a8c3ac630de39b53ef23d1742ddc0f5d2
AgentTesla
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
AgentTesla
b796ebc23a355b8fbd29552b2ff7142f09617c25a30a33d5a92626f69e337d48
AgentTesla
c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
AgentTesla
ccd1a40e599ad9f364ca70ef3d02b4850901fdeaddb5c9a4b66405e2bccc9ad2
AgentTesla
e2ebeb9d7ac12f7465a44a186f2bc83be704f09a003530f40474bb4546769124
AgentTesla
e7adb9ddc612bc2bbc52cc809b0a7b90c6f28f0b9df4fa767dccdab4d1d91c50
AgentTesla
f6dc39be69fcb6613defba0c9d8428d71c2a02b118383d4a49a66c6139e690fd
AgentTesla
+ 121 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/200930-d3vrylhj3s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Unpacked files
SH256 hash:
b80155dbd80f8bc5d3f59e08df47aefa42e73612aac6e8845fad3cae516cbdb0
MD5 hash:
0478256ba4237f2e33b77f8127d9a145
SHA1 hash:
560f2cd098bd81c18174d980652b28a8c90c48e2
Link:
https://www.unpac.me/results/f444a0b9-fcfa-4d54-80c2-019e8650d17d/
SH256 hash:
c880ea4463c608bb8f55690ff16983b7df8b21fd10491b45b82e3d1d987b78ea
MD5 hash:
85606582bcd5bd7ebee09e0ac89a344c
SHA1 hash:
c0d5071930121c8e3e05abe9e972c99aee745433
Link:
https://www.unpac.me/results/f444a0b9-fcfa-4d54-80c2-019e8650d17d/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/f444a0b9-fcfa-4d54-80c2-019e8650d17d/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
e8defbf9c06971815a69b11122306648ef6cb1f68c037de43ffe776b28555412
MD5 hash:
c4be1d461700ecdf8fd0be0f65c635b0
SHA1 hash:
ed5dbe76e8c2febdb2c99d547772773855cac623
Link:
https://www.unpac.me/results/f444a0b9-fcfa-4d54-80c2-019e8650d17d/
SH256 hash:
f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26
MD5 hash:
8ace1f1be249dd3fa64f4a9a988979dc
SHA1 hash:
d08077aead71290edb549bb83e5e63c985997d37
Link:
https://www.unpac.me/results/f444a0b9-fcfa-4d54-80c2-019e8650d17d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xls 430b0f7bdcbd48c46ce405797e74e37db99e2c453e8dd434eeb57eb9217b1781

AgentTesla

Executable exe f71494245a0d5304debf8b402ab8096593893d81adbabfa1540e013e0ec99e26

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/630721/
  
Dropped by
MD5 8262bbd0e520805f8e9f55739fbdca26
  
Dropped by
SHA256 430b0f7bdcbd48c46ce405797e74e37db99e2c453e8dd434eeb57eb9217b1781
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/67196/

Comments