MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b4b14bc3a05f06113b88f9a389517f497309b1609fa8d24d337fa4899def582. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b4b14bc3a05f06113b88f9a389517f497309b1609fa8d24d337fa4899def582
SHA3-384 hash: 82efae57428212b68da56e14123176cf7f48ef78af1612888b113a1076787347fd5c9b306570fb2a4a70042ef58b6b62
SHA1 hash: 7ea98eec5dd95fd4b159ede7d96784b10634a257
MD5 hash: 1d12b2733efec62f607f71eddd008e4c
humanhash: fish-virginia-kentucky-iowa
File name:P.O_6523.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:748'032 bytes
First seen:2020-04-30 07:36:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ffa3b46bd2034198985d725252fa90e2 (1 x AgentTesla)
ssdeep 12288:aKqiWyy2ewg7fz5DzJ/Xy2rqzTePAhiezh5Tyxot/lf7sgJQP7JWMSfgWv9/Z6V:emowg7BzNROzToAsBwf7snP8YWV/G
Threatray 11'012 similar samples on MalwareBazaar
TLSH EBF4C032B1E149B3C1B71A7DBD4BA7689829BE152D2855863FF01CCC9F3D691382A0D7
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.BtcMine.3329.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/174285
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2019-06-30 20:44:58 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
22165d0974fa72f7e87c8e5128cd1fc3fe6b6dc0ed8e990838229b3a92234349
AgentTesla
32ef6a3c172b8ab59ed668b0fbad8c05dda82428fb2d1ec8e47d9e6db076043f
AgentTesla
37d7cd08ca91dc9962cfd418aafc0d115b954ee72c181feaf7d986c1f56b26a7
AgentTesla
7ab75859697472c8bda10b6cb7e7ffa7c8f5ce5eae3e7c67a565ffad2c6de83b
AgentTesla
8948e4e0f392197b1c1436e5f7a2a7bc326c849b6129d8cf287a6d6a03cd642e
AgentTesla
982d2699709d7a024a542a4f771a544cf987ce8d8f15cfa3dcefca157b251e3e
AgentTesla
b946e20a88832d012f1f9286128213de93298da8fc2c9921042419e44479d4ca
AgentTesla
c278d60afb08f90ae60570f9e463a9554021f3c1bf88c9ffbfa239d77504d602
AgentTesla
e0e1906cf3bdce3052f97a950aef614488f566a4d587428d64d0c848f97a7a4f
AgentTesla
f2db78e5165646f19a5b9438764740b24ab4c578890cd68e292cedaed3f7ca84
AgentTesla
+ 11'002 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments