MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 151fd7b3871f007957de4aa59048b9a25a68784f0d7e4e77e9ee6f26f1256702. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 151fd7b3871f007957de4aa59048b9a25a68784f0d7e4e77e9ee6f26f1256702
SHA3-384 hash: 16823eea5ce02ea634b54b91a9166021eec3530874ee0b450766b7a1a3428e1153f074277c857ddad29857f24efeffeb
SHA1 hash: fbb0f18975525fa276dfc3666b318e9fa215ec6d
MD5 hash: 3eb01a8d8e5f1debef30bc6b8507699d
humanhash: mobile-orange-freddie-zulu
File name:order details.XLSx.xls.bit.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:450'048 bytes
First seen:2020-06-29 16:10:44 UTC
Last seen:2020-06-29 17:03:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:qgAfto8Aitv2x5+3Vf560w+YugA9n2yZ8kKbOJG2wZ+tfbmQTUaalDY8DBRUR:ROtI6m0wGZn2ySkcOJGBZYjTGHUR
Threatray 10'594 similar samples on MalwareBazaar
TLSH EDA4011636AE6F16DAFD47FD50B4601083FAA43E2502F35DAE8671DC1B52FA50A40E2B
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/16485/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WOR.3073.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/151fd7b3871f007957de4aa59048b9a25a68784f0d7e4e77e9ee6f26f1256702/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 16:09:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cup5pm4hd4ahsv66jkszasfzujngq6cpbv7e457j5zxsn4jfm4ba._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
11798aa5516a8f71c584946859498678274b20ad961bfabe8d65049457915c5d
AgentTesla
1ac93b118f2f6facc20288611532e4f0f898967e262a6c9cea66bc2da07ad732
AgentTesla
2bff0b840707457db9933a7ec8657216c9321fb18d9515371a9fabca227aabe7
AgentTesla
5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f
AgentTesla
634b35f814ecb44977e2e9f0e34d83ad96d336ccc87bdecf703f1e0c44a2c69c
AgentTesla
a08005202c9ef8e303347f938d73e2bcc58548a5b8904f9d242f31d7b868b725
AgentTesla
a2afda47f4169023bca3c730a48e58d6c40e84236b959a871e883ded3304d5fb
AgentTesla
ac14d182546457a8a75ccd5ed95a06f4d3983cd375bfb5fdc8615e2ebe3837f6
AgentTesla
bf2f666cc2bf3dff6a34835ddd2b78a8cf6a6cfc2a725e81226996010669ed2b
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
+ 10'584 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200629-1atb9j7qms/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads user/profile data of local email clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/16485/

Comments