MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11f9f60f3980a42f06858e5e684b8dedb4b134e9bb357a1043ded9a96353744b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	11f9f60f3980a42f06858e5e684b8dedb4b134e9bb357a1043ded9a96353744b
SHA3-384 hash:	c90a4de3c8ad363a196a9f6e64e66a81e4c711efcfb7064dccf3c7edd35f5e00fca9702ae6f268180c1dd14270d67dc8
SHA1 hash:	bfd5029a05228e978bd4619d8e3d48bc675a23df
MD5 hash:	a18ec2dd546e68f141c8dd4448b28413
humanhash:	cat-bacon-eighteen-twelve
File name:	BOQ.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	707'722 bytes
First seen:	2020-05-06 09:37:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8da9eca94b48f9aad7e32957faa069c0 (3 x AgentTesla)
ssdeep	6144:cTQ4OtDA0TrYM0ik4tZUBBYYRGBFE31J/xE61C/MdTh0Q3ZZq:v4+nYFWokIlVOo5h0QJZq
Threatray	10'738 similar samples on MalwareBazaar
TLSH	89E4BD35B4C4D214C2A540354BFAFAB529696E222B045A7E3DFCBF1F37FA17610E0266
Reporter	jarumlus
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.VbCrypt.250.24123.3311.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Vbran

Status:

Malicious

First seen:

2020-05-06 07:57:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 31 (93.55%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ch47mdzzqcsc6bufrzpgqs4n5w2lcnhjxm2xuecd33m2sy2torfq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2d8ee7ff9c355030ed9617084834bdd9f468ff47bb2274fa69163f424d471d0c

AgentTesla

5a1ff51485fd7f49e413093ab5c705265a6d5ec108c1ce955fbe99da3d29aa33

AgentTesla

6824c4afb5e56e0c2b3e0b89a4acde70bcc2bd792334a6600225e623162ae621

AgentTesla

73227e5663576f946ecdd31082bd8ccbd65cb8332f3ccff9807d43c2481276aa

AgentTesla

90ffadcff25b2faecd4cccabac3af9f5329aea12e3330aa408545408bd482fce

AgentTesla

94fcc8c7fd53c5463c0d33d1f74b5c7c8c0ae95ef097477958acb9df1ae5a15e

AgentTesla

a596fdfb8997f081dd7674b248d02518f1052fe4b1c384a050f6a82b65816311

AgentTesla

c3196a4d4498a77b2e27353a3cd61ce5494bdce1f29f5643e8fece30aba5a20e

AgentTesla

c86e4587d8ac247c2fc4cabe89298dba2537468f4eb745d9bdd48b9ae7c29e19

AgentTesla

+ 10'728 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-221cqpzf32/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Adds Run key to start application

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar