MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a13ba6b394ff6c4792edab2d8ee52651fa9ecfe014059b951d28d2f4383f101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a13ba6b394ff6c4792edab2d8ee52651fa9ecfe014059b951d28d2f4383f101
SHA3-384 hash: f72de3c57d68b0cee06ae73962962e17d808c8fc173967056220fdd5369344843af1a616932a77f3ba6713b35afea34e
SHA1 hash: 86b63c28ba26f00ea34ce2e30c310b065767f854
MD5 hash: dfcc57d89ca61c9329bb0add87565fbb
humanhash: mirror-emma-angel-bakerloo
File name:ejima cripted.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'064 bytes
First seen:2020-07-07 05:32:33 UTC
Last seen:2020-07-07 07:22:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 04726b68348c0c3cf827797a9f6695eb (10 x AgentTesla, 1 x Loki, 1 x 404Keylogger)
ssdeep 12288:r4p4rqo6AW98JN3MS57jlX68BsGLXw64alLCPl4nFj3tRmlmN6nE5tDaS:rBm8mFS57jlXSGLXwjalLCPEFLtRmjET
Threatray 11'066 similar samples on MalwareBazaar
TLSH C8A423A5EB4BA8B0C19C2DB2C04F29741E80E1513DAD17622F60DC9DBFB2DD6AE11747
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21803/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Reading critical registry keys
Launching a service
Creating a file
Launching the process to change network settings
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a13ba6b394ff6c4792edab2d8ee52651fa9ecfe014059b951d28d2f4383f101/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 05:34:07 UTC
File Type:
PE (Exe)
Extracted files:
71
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bij3u2zzj73mi6jo3kznr3ssmup2t3h6afaftokr2kgs6q4d6eaq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
21d19ba98de8b710605e144809cae73bc3b7606cfc49e995a267cf44e4c2638f
AgentTesla
50e017de70cd0bbf71b8f4e687d56b796cd355b38c30076c7769d8b0b8562449
AgentTesla
68a8d363bbf1320d590f3f7aaa877caabe67c0f9dc465da5342b243e688cb1f9
AgentTesla
725cd49294a79dc41269efe8765a70ca9e745460d1af90c5e1b019c1f2e1a0b4
AgentTesla
8693d6aaa3f5cb0e2c6e725eaa9d6abf1bcf8f8390625767312b5af32e204118
AgentTesla
a6aba7b7f6eeeb871e7c58959307a260e3f20b54b7d4a174c9bc03ce4eb94a94
AgentTesla
aa218adce0cc32486a75b6e5a2669c8b82afac444485f3d44bb168482276ad4e
AgentTesla
c04c4bb521cb18dc16fbacc4220c0f854bfadfdc0c016ec6fd868d52fe8c3e08
AgentTesla
dbbaf0499e544e3832699110f71f62a521ec93cc8a74656c92af7023f554d897
AgentTesla
eecae1c4f0341afd1a089da83da76e7a1e31f3f2243269722c9d0c9457c2ef85
AgentTesla
+ 11'056 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200707-ksr1hw4fqs/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8d03da5d7b3b715f737f0d1f637ce408283fadf713a0dc766d575385edc51d0f

AgentTesla

Executable exe 0a13ba6b394ff6c4792edab2d8ee52651fa9ecfe014059b951d28d2f4383f101

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8d03da5d7b3b715f737f0d1f637ce408283fadf713a0dc766d575385edc51d0f
Cape
Cape
https://www.capesandbox.com/analysis/21803/

Comments