MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe
SHA3-384 hash: 67771c97d411825aac6b6393305efe0369b1aa011a2c96eea58603ea2d148f123868e6229c82a6cc845b324e2563beb3
SHA1 hash: 6beb5a2ad072e233c67487c5b3593a21748e3162
MD5 hash: 5e63c6b951cdc18d4725e562bad6bc4f
humanhash: maryland-king-california-shade
File name:5e63c6b951cdc18d4725e562bad6bc4f.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'105'408 bytes
First seen:2020-08-31 05:32:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 73ae1eef07955a270fc7a7f873444c85 (16 x AgentTesla, 8 x MassLogger, 5 x Loki)
ssdeep 12288:lR/MXPsQjiTiCAeeJpWkjumgIvSQCutDEVFbtir4247AQrns/ndVtGJxb0vsXrcb:HQvrCXEucruic247nrns/7w0v6Kug
Threatray 10'024 similar samples on MalwareBazaar
TLSH 60359D72E2924437D1732A389C5B53B49C3ABE036D2878467BF9DD8C4F3968139352A7
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/53226/
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

PUA.Win.Adware.Webalta-6879873-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Reading critical registry keys
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/454812
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 279780 Sample: DDhpW6WN90.exe Startdate: 31/08/2020 Architecture: WINDOWS Score: 100 28 Found malware configuration 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected AgentTesla 2->32 34 Machine Learning detection for sample 2->34 6 cairo.exe 2->6         started        9 DDhpW6WN90.exe 2->9         started        11 cairo.exe 2->11         started        process3 signatures4 36 Multi AV Scanner detection for dropped file 6->36 38 Detected unpacking (changes PE section rights) 6->38 40 Detected unpacking (creates a PE file in dynamic memory) 6->40 50 2 other signatures 6->50 13 cairo.exe 4 6->13         started        42 Detected unpacking (overwrites its own PE header) 9->42 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 9->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 9->46 17 DDhpW6WN90.exe 2 7 9->17         started        48 Maps a DLL or memory area into another process 11->48 20 cairo.exe 4 11->20         started        process5 dnsIp6 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->52 54 Tries to steal Mail credentials (via file access) 13->54 56 Tries to harvest and steal ftp login credentials 13->56 58 Tries to harvest and steal browser information (history, passwords, etc) 13->58 26 bh-58.webhostbox.net 199.79.63.24, 49704, 49707, 587 PUBLIC-DOMAIN-REGISTRYUS United States 17->26 22 C:\Users\user\AppData\Local\...\cairo.exe, PE32 17->22 dropped 24 C:\Users\user\...\cairo.exe:Zone.Identifier, ASCII 17->24 dropped 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->60 file7 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe/
Threat name:
Win32.Hacktool.CeeInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 05:34:04 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fzso6qdl77pbnw2g5ulqnwlaqmjln63pwnpb2e5xuvphjk3hx7a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
3620b064389d3957610700c51595f52e92e613ddbcb70526345f8cd73f44c718
AgentTesla
38de2a27f6860ff3215434f3088f37ffc36c3a487fbfcee619bd1af281883624
AgentTesla
4d27b24408ccaed59ba5977e7e7309fc42fc9964bc4e3d4cd3ac363f1b539454
AgentTesla
537138289e71224816b26b83db4b7d5fe1021e7b915bb512bdb99b8ae5969aae
AgentTesla
757f7141daf24169ff3694cdf0247b7ce0b71c66a970837a71149a69b5b6d371
AgentTesla
954c9a92e5e95783711ac9da044757457e9428c0e9f3cb58f03f3acbc2c59c22
AgentTesla
99fa917c6f97756ac7ced3ca06142728178550f72be70326ab30420fd4e9797e
AgentTesla
a2c5f74931c1d6871db672270876c1cc80bc90d4b4bca32355b95e762d30e246
AgentTesla
d169af713aac6178816694e1006b2e9f6411687fb13ed0402792222d380624f1
AgentTesla
ecd0c9515106232ce9cb2e64bd93d688a4e6211dd0a42582f39435c3652ccf86
AgentTesla
+ 10'014 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200831-m5a568sdvx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/436422/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/53226/

Comments