MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412
SHA3-384 hash: ff2d74c47febdcda0700c4beee0b95ca4cddeca4ebe27a9e1f28c0eea54874eadf97830f8a74b8187943fde8bf92a54e
SHA1 hash: 8ef5dd7e42d0c6009edecf6db259948eb4c595dc
MD5 hash: e1a1d6a91fa9f6d7e5ce1594644fdbd5
humanhash: crazy-arizona-berlin-video
File name:Order items 2652-21-22.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'006'592 bytes
First seen:2021-07-16 11:11:40 UTC
Last seen:2021-07-16 11:40:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 12288:ASzxZ0EG3KQyTs4XlhyI/vbUFobp56cyr/LlDFGefmY6cDAEME7Vs5y/TE5peJ6x:ASF5/KLJFG86kiE73JkXm
Threatray 6'927 similar samples on MalwareBazaar
TLSH T11A251F3E6AA42A27B777D2644681C015F8BC91DB3A395DD742C7698C350E8027EE7F2C
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Order items 2652-21-22.exe
Verdict:
Malicious activity
Analysis date:
2021-07-16 11:12:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/84726e44-a21f-4e3c-b8f0-437c133d4818

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172177/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DMC.genEldorado.23105.7443.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89b9cd59-f1c2-4985-8795-d1c00f92bce9
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817416
Signature
.NET source code contains very large array initializations
.NET source code contains very large strings
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-16 11:12:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=65z7dbl65vcavzpzjsjuymv4beqwehj4gs3lgr6idjvlpakggqja._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
25c6ed88a34e97a0d1c4c8fa3d2c90a6b39345a56f0dbf5775bb2e4d2320415f
AgentTesla
4db148b755b23786d900184cbaa5a8c84943b34270186638aaf29933a2b1b6ed
AgentTesla
5c17ad97be2e3d64846a0150594f54a6fc033e68b511a0a2e7fa0469306745ec
AgentTesla
66bd41f42be4e3ef4d73b4d4c68c52c32dab1aea1e7e772c8e7ad6bf16e65331
AgentTesla
a151c4bd6df1aa4e94675c10e27a75dfdc56a22b150229b0a761bd3d2d9dbd10
AgentTesla
a261898485667823b47ab6885b0cd8c16d126bc0f1671dd7aeb9b675aa01aff0
AgentTesla
a72b5e537bb683e6f899eed4d01dc5651fd08444d2e652ca069565b388319b5f
AgentTesla
c8a8b43ec47c6c9831e275e2009ab58f7794374b4876fe72dbc4151296330aec
AgentTesla
dfcc5df6ea28e158b19b5168275bd140720d5cd73e3df9dab5ecb513255d21f0
AgentTesla
f06c40df7dde44469aa47985010736dbd83224df91951b9d55cdb7a377353a61
AgentTesla
+ 6'917 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210716-vmbpmhrtsj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
82a4065578bf324c5a382d4e43510bfe37dc2d4accaa25792aecea77c7387714
MD5 hash:
ecff0ff8f308ad9a7ab4e8d8c6632f1f
SHA1 hash:
b2149cd8ad0767e9ee467d85f7f5d97494ecb07a
Link:
https://www.unpac.me/results/4effb61f-1fe6-465c-a560-8e506727eb65/
SH256 hash:
eef6388c819ed44391030b919e3e00c310b68cfb7e1b689f59076379d7055f53
MD5 hash:
0a091a8167718f6b3583cf25c69f43e8
SHA1 hash:
63c709698fe2ef557880058281d63bced8c02737
Link:
https://www.unpac.me/results/4effb61f-1fe6-465c-a560-8e506727eb65/
SH256 hash:
35681a53c101cc982671447c8fabe2d1337a2b1f056d6a243dc3cbc2f7d8c8a8
MD5 hash:
7a5999bf2197cd4e208e32e67e04bead
SHA1 hash:
0d406f0a277e1299b2bacfbba074726b052b2558
Link:
https://www.unpac.me/results/4effb61f-1fe6-465c-a560-8e506727eb65/
SH256 hash:
ca5c51e47b6ce5a54a28614b35d895bed311872830539d56e703c95d67de469f
MD5 hash:
5f8cfff7dfb517a0a7c03bc5de5daed4
SHA1 hash:
05bc8821cd40081932d28deaa72855187128bc72
Link:
https://www.unpac.me/results/4effb61f-1fe6-465c-a560-8e506727eb65/
SH256 hash:
f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412
MD5 hash:
e1a1d6a91fa9f6d7e5ce1594644fdbd5
SHA1 hash:
8ef5dd7e42d0c6009edecf6db259948eb4c595dc
Link:
https://www.unpac.me/results/4effb61f-1fe6-465c-a560-8e506727eb65/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d8cee88209eafdf76e683c275e9bcd74f02f3604d70fd5591a272d7320e1e27b

AgentTesla

Executable exe f773f1857eed440ae5f94c934c32bc0921621d3c34b6b347c81a6ab781463412

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 d8cee88209eafdf76e683c275e9bcd74f02f3604d70fd5591a272d7320e1e27b
Cape
Cape
https://www.capesandbox.com/analysis/172177/

Comments