MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a7e38319cb2a9a43f874fc3a6b2f4afcacc84386284982c61b2effaa318fd1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a7e38319cb2a9a43f874fc3a6b2f4afcacc84386284982c61b2effaa318fd1d
SHA3-384 hash: 572ce82d773ee4af25e28ce2d5531204944306806f4355e97349cd3df3178b9f1306ebe9134baa00fd9d673ac7c12f26
SHA1 hash: 38d7d2f96647410e3ed6f9a6fc4bc1b4cff05d94
MD5 hash: ce714b48edce8db2524fbbfda51af906
humanhash: foxtrot-lithium-uranus-nitrogen
File name:ce714b48edce8db2524fbbfda51af906.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'864 bytes
First seen:2020-05-13 07:10:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:aa9nBRVIOn0S+kvZj28W6gcOHmi4xu5RfpRnsLtVgycR5nJzcmDMvfeUAvBFh:aat5Iw0S9vZjqpPh5RRRsUyS5PMe7v3h
Threatray 10'747 similar samples on MalwareBazaar
TLSH 4394122EB3F9492FEB7A46F84884430543F08279AE56EBCE4CC068F5464E7E762155E3
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR.29109.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:10 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dj7dqmm4wku2ip4hj7b2nmxuv7fmzbbymkcjqldbwlx7viyy7uoq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1
AgentTesla
2841a78e3acf75956e7ed6ebb99cac1a3e349cdca5e9113381a997c5e1ecef47
AgentTesla
3497f186cb8e8ee119f82a97445bb6a6d75a73d480a57c12a864fcb7e8b3b725
AgentTesla
3f586a9069a061665c11d0ccd94053ecab68d37d7e293fe9bc6a6dc9701e14e9
AgentTesla
4fba937f1e8ae7eab73de2233f36e813fc2e4e889cbf5103f72ed642ba2e76c3
AgentTesla
5adb192079fbc16f4631d3e5c894d9bec1ed384e7be85742c4f076760eb64a0f
AgentTesla
6af32b6b849f1186317e65f84c1d59cc03ce878ca8e3706c5d7afae2389b3c64
AgentTesla
b20c989115553de604a8f7f6bd58ef25920c241e1f5af881008aa4dcb21d79d1
AgentTesla
b8cf49555f75f9f06bdfb76150d4b3e1a01a831a7eac7b644dde084c212a43d2
AgentTesla
ba6c27eedbe9c1152f8232f685600ec69ad11ada7b6e82db997e08d89a1b0385
AgentTesla
+ 10'737 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity keylogger persistence rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-fqnzn8kgv2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 1a7e38319cb2a9a43f874fc3a6b2f4afcacc84386284982c61b2effaa318fd1d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/361907/
  
Delivery method
Distributed via web download

Comments