MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f77e69d710a9b85bbc8484b9d4149cce5d29d1e2fe102170c637f75c93e362. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46f77e69d710a9b85bbc8484b9d4149cce5d29d1e2fe102170c637f75c93e362
SHA3-384 hash: 513622ab834a307c121ef767e4f241b526462be89f5a8723e574689686256e9e1d3ec314f24788b6704888a363fd3da0
SHA1 hash: 61b9c6abd620714c2fb12424807e9d9f6b79eaff
MD5 hash: afffad60976fca48f39c8dac2a795bb7
humanhash: kentucky-alanine-fish-east
File name:Confirmation Letter.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:530'944 bytes
First seen:2020-05-26 06:01:07 UTC
Last seen:2020-05-26 06:49:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:OcAvAbjzM6WYWlemcx2Zb7KCtUHXd9ZCdkSbyYD:OkE6OlemcJf
Threatray 10'651 similar samples on MalwareBazaar
TLSH 4BB4BF9C7650B5EFC817C976DE945C20EA60B4BB830BD343A41326AD9A0DA9BCF115F3
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisAFFFAD60976F.7392.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 08:02:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
096e367392216bef16b7bb081ec13edbf71a774b5f8de11fe22a15fed254f8c9
AgentTesla
9b2c90b93c9af7fb8cec51700f72b69a78e7d730f34ad7804911b6b0c139c4ef
AgentTesla
b4e950994387c2d8dd5473be110004b50156454585ce6c72751d4e793b2bfd36
AgentTesla
bcfe28b074cc1d9b0fb7896ee3eb4d28c240bee33cb76578f0f9f1ef90ab92e6
AgentTesla
bdbfc7d1632cd7d8279b0fee3770abe6f54198d62c3781cfcf098f892c598b21
AgentTesla
cffb6736521771821af04e2caaaf125e1d475bfe7166fcb39ff7db14c41931a7
AgentTesla
e0e75410c585dcaeab1ac774bf62f0ccc55ec32e009fdf75a8f089438e5b65e7
AgentTesla
e4bdbc72938f14ea66de9620b653a03bcd0b4c6b3a3b6bd7335ef15872dfb7cd
AgentTesla
e836f76c716c021e89d19ee4e4456e04b04b1041fe04fdaa6ac7523d35ef3b60
AgentTesla
f8166c3c857a7a3ba99515cf6ae242a78050fba7608e24a88e2559e0063a187a
AgentTesla
+ 10'641 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-rrrtge6xh6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 0631c94fdd37b2e9af70b63823006bbc36487870633683e797790fc64d20ab7f

AgentTesla

Executable exe 46f77e69d710a9b85bbc8484b9d4149cce5d29d1e2fe102170c637f75c93e362

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 0631c94fdd37b2e9af70b63823006bbc36487870633683e797790fc64d20ab7f

Comments