MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 409fcfde81862a0579c3035388f5036a47282898a6dfe3c7a686356400e2a9f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 409fcfde81862a0579c3035388f5036a47282898a6dfe3c7a686356400e2a9f3
SHA3-384 hash: 704f2218efbf819a3091c87fb5fec427aee4f2a5d04b62cbb22a01e3233ed00d191027a9f1c3c1684356bdeb0a01bc1f
SHA1 hash: 264d56f039952657b6eea09c178965dd4cbf4747
MD5 hash: 538b31d305d31813be7aa9d43a5124a6
humanhash: undress-zebra-mango-sixteen
File name:63372-86-1.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'721'994 bytes
First seen:2020-05-18 04:25:40 UTC
Last seen:2020-05-18 04:40:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b4f5b6ddbb1c6b997c1a245dea0a0338 (4 x AgentTesla)
ssdeep 24576:gTAD/2bDt4IAETwH1mXxQbdGRgbPUPsyI+NO0lCb/otYy+H7q8zjgUxgHAjf:R/2bZ4I+mXxQbwXNN6/7eo
Threatray 10'703 similar samples on MalwareBazaar
TLSH 0685E513BB902819F1739870A974652A6C25BC331824E95FB381BF8E3972697D5F072F
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis538B31D305D3.5848.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 04:35:23 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=icp47xubqyvak6odanjyr5idnjdsqkeyu3p6hr5gqy2wiahcvhzq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
5331c0d3bca792163c516ede19eef0b09e4f30ebe1299e83c9d0ca9b1701632b
AgentTesla
62b19e7d5d6ae7d5f20ac030ccb604797fc054ad153b8095513c9874b2e5f45c
AgentTesla
70d902bcf8abb0e949bf28c9328f0073fb3c16ab85d515d26f6ff7d7d1c08efb
AgentTesla
7ff5bd9b4c1864f40e3b4099505941d706bd39f992f2cd1559fb10ea2d19651e
AgentTesla
82e78f0c4c0c6064ba96cb12c0a4a9094b57a49540a053fe27f290f12e3afca1
AgentTesla
8b9c0996b6758d8420a490ef1288e12106b78b983c75ecb23f39c8dd09dcc737
AgentTesla
b7a5fa475f3dffc48dd10e17c0aba7013ba58752baf49fb83e634ca0d16a61ce
AgentTesla
df696f5fa3df8ce1eaca951cad491770b1d7aeb6e6326a360bcdb266f6d31620
AgentTesla
ef198e1bc193d5b0e033b27059f10e3ae7a5b696f2157bda94d765cc353d6952
AgentTesla
f6d0d87029e9fe0442daace762e6a0f50db7091ac9417b30e43ba63f9598d5b2
AgentTesla
+ 10'693 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-ztm1g76v16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace eeb0b8580e757586a984cd0ead15813d0a4cc60887be0c9535f11485169be896

AgentTesla

Executable exe 409fcfde81862a0579c3035388f5036a47282898a6dfe3c7a686356400e2a9f3

(this sample)

  
Dropped by
MD5 00ed367320faad923ac58bf873419f2b
  
Dropped by
SHA256 eeb0b8580e757586a984cd0ead15813d0a4cc60887be0c9535f11485169be896
  
Delivery method
Distributed via e-mail attachment

Comments