MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66f42e92f47e38a4a83dccefb6b2799c28bcaafa59cd5764f322449607ecc612. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66f42e92f47e38a4a83dccefb6b2799c28bcaafa59cd5764f322449607ecc612
SHA3-384 hash: 5757e2dbcd498ddb08df966dafb140dc6b54678e2c061c0eb2d7fafa6439753dd16c50a5c6942d1018ce9f11b8f803a4
SHA1 hash: 33a73dd9dc89ccf258d432e860d13758e1e8e9ba
MD5 hash: 736eeccc0c55ba43fc378e164884c6ff
humanhash: east-grey-india-eighteen
File name:Order.xlsx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'688 bytes
First seen:2020-06-17 05:52:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:gNkhzrrqK7iiOAjk7jwRlp0xeqDx2YQ1Km2ezRkCzGpmYUdq7PvCrgQU4MTdimh0:gMrqKi9Ajks9pwm2eNk8xMPKfU4ydJh
Threatray 10'645 similar samples on MalwareBazaar
TLSH 0594DF207999E198E99AC2302126F97806BD3DC397D3D5285ED8BD8FF775B000E7261B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.kteadubai.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19081/
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 04:22:44 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m32c5exupy4kjkb5ztx3nmtztqulzkx2lhgvozhtejcjmb7myyja._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05f08d66b6f118c60851b9b3a9f86eb9db05955af1bb2b6bbdd9b5308972b3b3
AgentTesla
2f4964e14972eafa98f1fc8ad81f8dc2eeb45a00ef420cf59db34faba1592ac4
AgentTesla
5154fa2ab923d2c482778140eb4953ed8a225dbe6eaecbd4f6c9cf8e14623e85
AgentTesla
56e463f760bf1035c13ba35fb49656e77c149f7f2d82b2d403d7191bbf7eda71
AgentTesla
5e570c2f5a2d7d214e8ecbe04ce55a88dac0ca339932ec54d3027804b2f37bf8
AgentTesla
8d98cc9cafea7bf31e27287f1002cbade82ac19f44d2b12584598509b8b10c99
AgentTesla
b7c3d65ccde1c6e2784e6e144dda9909101aeb382d1036b9019117aae30217b7
AgentTesla
ccfbbefb33733978fd04e44d58d874c1ce2ec38f0d8568a0b105bc138f72f2e1
AgentTesla
d90041e6b2a7deca5936829d8a2f6b9c190abcab6c81c3a99b22d41ed6fffbb0
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
+ 10'635 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200624-t289at9t4s/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/19081/

Comments