MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 573535f4daf60e724e68c766dfa8ac52bb96b33d4bbe307e36730725dd0f40b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 573535f4daf60e724e68c766dfa8ac52bb96b33d4bbe307e36730725dd0f40b0
SHA3-384 hash: 13461ea4614eb702ba6ae9e47d57c75d8f499edfa5e9c471b9c3858edb865178177e31398a16731533cc87973c392944
SHA1 hash: 737857be858904c32029f4e9188642e61dafa707
MD5 hash: b0d32ca2e99618b7c006adfd78d137f6
humanhash: whiskey-autumn-blue-finch
File name:June Payment.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:618'496 bytes
First seen:2020-06-22 11:35:59 UTC
Last seen:2020-06-22 13:09:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:xoS6Wao8GeddLIKLtfNDT+JjJsPygVR+TD8:bco8/17DQJerR+0
Threatray 10'662 similar samples on MalwareBazaar
TLSH 6AD43B3A7A857916D63C093208A955D063B1A6473E02CB0F79CDA79C6F437CF3B8539A
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12551/
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.10809.16249.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/573535f4daf60e724e68c766dfa8ac52bb96b33d4bbe307e36730725dd0f40b0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 11:37:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k42tl5g26yhhettiy5tn7kfmkk5znmz5jo7da7rwomdslxipicya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06eb97d52358e09f7c5ee8913149bd830580e9057809e81fee718759db301687
AgentTesla
7aa2e610774aeaede163770891fe671e27c484405eddb143631982f3cad77595
AgentTesla
884ec2901e7bacdf6f6a84383997a8e4fd297d18009545751cef558ae726472b
AgentTesla
9023f7b2da3424f0542a1ccf961ad9a6f55c37351cf530e8811f9875bf3a6f8d
AgentTesla
a6d44377671c37e4ef84efae15b17efbcdd03a8b5af2704e74f75126f333196f
AgentTesla
b5258ddc74fd2d455241f16d2505ab8c67b590fde3f5475be867e28c7856be07
AgentTesla
de54a16c8d1a17a0eb2b797cb1fd7604ff1607e53cfab3b05f1fc9c28f1f83b0
AgentTesla
e06678f901a62946c8efbb77629b9af98d52bba1c8c39e509c4ac31081ea3486
AgentTesla
e30821af035b182de6dc8b54d9506383cd5a5713c4448faa4c842763371063b2
AgentTesla
ec766638dbd645faad5115dab7ff18b9e2afb5f4a0da724ac945ae3e50815b06
AgentTesla
+ 10'652 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200624-l9td6depna/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Executes dropped EXE
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

AgentTesla

7z 2cad8e8b32164388a5db3846cf43b4c2e24a6b709bb8b6d8baee8ef1abbf0e11

AgentTesla

Executable exe 573535f4daf60e724e68c766dfa8ac52bb96b33d4bbe307e36730725dd0f40b0

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2cad8e8b32164388a5db3846cf43b4c2e24a6b709bb8b6d8baee8ef1abbf0e11
Cape
Cape
https://www.capesandbox.com/analysis/12551/

Comments