MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6de7efc9e04cb4db0acc603a7ed700b186d0545acd0e8e84a1d8cce668202dc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6de7efc9e04cb4db0acc603a7ed700b186d0545acd0e8e84a1d8cce668202dc8
SHA3-384 hash: ac1b50203fc62d2c1cd17e31013fa39f6e0be152f4a4bf4e55bc4cfad3c3c6790a2e2bc2c9a503751e34e328b22ed4ee
SHA1 hash: 3b215b084b9ff049a860fc29108f62c4b6d2133b
MD5 hash: 8cf823ee0766126638d33918383ca5d8
humanhash: kansas-mars-monkey-zebra
File name:RFQ.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'448 bytes
First seen:2020-06-01 11:33:13 UTC
Last seen:2020-06-01 13:47:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:wnVRurAiBV91OSN1f18O/H4onv5BdaHDfD0UPb:wVRurAiBV9bN1qg4oBBSUUPb
Threatray 11'272 similar samples on MalwareBazaar
TLSH 3F94124DA3ED943FD9A811F69882310853F145E72187FF880F22A4F79DEA3D52764A87
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
5
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/5483/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 03:53:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxt67spajs2nwcwmma5h5vyawgdnavc2zuhi5bfb3dgom2bafxea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f3fe234c700b316a460c05098c843efbb0965b672d0e7a6f58028669c37ccb9
AgentTesla
271d081750e61123ceda8a898533f5b636254030a65f14a71ecae2b8ea649443
AgentTesla
400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320
AgentTesla
407a92dc3261682d19c7e6431b78c67470a498079f261d3c729d2e89b689b573
AgentTesla
74e0eb3b39810ae2847ba2238bcf8fc178c187d7b783f865c262117d933f6d4c
AgentTesla
9fb5e1d1b16b1a20d4994176d4579a90dd2e0a87b0bb6cac123e9894278f61ee
AgentTesla
a3f8c63b9925504706f889dc1bc944a5485144007b80b042cf53accda4f650c1
AgentTesla
aad10ae8b03a3f2997e124184b6256b88c69a61bfdd905b06ffa90204efeeaad
AgentTesla
aec020a6546f4efe2d5766ae7e7da2816c11badee1879d37de7845538b03035b
AgentTesla
ee02d4480e7e74c5015af1c4617271afb1ea208b0992050726ae3bf44e268cec
AgentTesla
+ 11'262 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity evasion keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-4ljt2fq3d2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies registry key
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Drops file in Drivers directory
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4b53a882fc87d037002401e58db022d2d9436c4e591b9f8b6817286267074295

AgentTesla

Executable exe 6de7efc9e04cb4db0acc603a7ed700b186d0545acd0e8e84a1d8cce668202dc8

(this sample)

  
Dropped by
MD5 40ee0db5c87d78a3afa486b5b5dfd9a0
  
Dropped by
SHA256 4b53a882fc87d037002401e58db022d2d9436c4e591b9f8b6817286267074295
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/5483/

Comments