MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4119ad71f4f0b90b51e983fdf38008b853ebdfd0db175704d59fcbbc2adb8cda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4119ad71f4f0b90b51e983fdf38008b853ebdfd0db175704d59fcbbc2adb8cda
SHA3-384 hash: 5e9dc6be9bdf8521711efcabc79e5505f57635f3ed6a8c157f684e9a60393106bd1c525d3b7dbcb1d9ba07678f2c484b
SHA1 hash: 99f4f4ec4c533dfe07dc103cf45d7c3277098fde
MD5 hash: 66dea90a2b6576c90fba2c20cf02bd9d
humanhash: delta-angel-cola-nevada
File name:66dea90a2b6576c90fba2c20cf02bd9d.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:360'960 bytes
First seen:2020-05-28 11:36:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:mt+rCt8XHVbO/7+nMWFHKOMWd8xKS03kZrTLTBl1HU5cAKCDUAaP:f88XVnvFHl58x+3WrNlCY3H
Threatray 11'315 similar samples on MalwareBazaar
TLSH 4F7402B536DC1DFBC23900FB0512890987F6886764A6F3CA2EF7A1D345E8F9862056D7
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
premium57.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 11:24:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
19 of 30 (63.33%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
205a2f88f490388970c68b7512acfb90756655b4115e3bbe7b2b77efeab58bdf
AgentTesla
275559f7e9052564ecacedb07b93ea0e552fe3cf4d5b3bbf315e1494efd712e2
AgentTesla
2c8da0da6cbab2366291deabbb773bec304a9e49c87982a04d6ee33c712cd642
AgentTesla
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
52594dae04135a7be866b5a1e1a12328d6d3fcdadeedfd5f8a267d7d67974165
AgentTesla
67819aacac4994b55659a8f7924ec0384e667ee74fe5b431a731ac5baf69448c
AgentTesla
71146568c5f7e1bc849a6f73bf08ba68c14e73fcaf049da083879f15a2cecc44
AgentTesla
892f1145f83736f0b5c5d6e82843a920102f14f1923076785b3fa105c004a1ff
AgentTesla
d9de85befd2a9049c9cea121bd32279d960716c95faa879b2863bba74ed8489f
AgentTesla
e651957af4c527f8a23f8c3094232c887e2a433974ab54e48e2519e8361809a6
AgentTesla
+ 11'305 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-pwq7x3143j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
AgentTesla Payload
rezer0
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4119ad71f4f0b90b51e983fdf38008b853ebdfd0db175704d59fcbbc2adb8cda

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments