MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79b6263f604674cb68c8e655aff4c134e433c589f00e55861c39ad7d6b4c3008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79b6263f604674cb68c8e655aff4c134e433c589f00e55861c39ad7d6b4c3008
SHA3-384 hash: 8d25d61f359cca4fac8b414c01473865a1645d16d6a4cf74961430be61d5d8ff05a4638ee83f78058000a1aec7468b43
SHA1 hash: 2cf2bbcc9583aa17b7dfbd7a25f989cc19efebdd
MD5 hash: 5dc30367a106eea527a342c9c515efee
humanhash: freddie-rugby-queen-vegan
File name:5dc30367a106eea527a342c9c515efee.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:288'256 bytes
First seen:2020-06-03 08:18:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:Kj2ck+msiBPitQPa9NbqPEQuq3TINJ1qi4AE3VW5gr5yaPnd3VGSURSrlPWUrWUN:Kj2ckIi0QAJQJDE25hFASURSrdWv9
Threatray 10'598 similar samples on MalwareBazaar
TLSH 4354296D6B88B902F73D5D3349D5166013F190934E02DB5F6FC06FECBA4A7CA294A392
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
server257.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 02:18:17 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pg3cmp3aiz2mw2gi4zk275gbgtsdhrmj6ahflbq4hgwx222mgaea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01c8966718aa1996c3b0460be4df08ec32e4a17af72a27947060a6fc07c7455f
AgentTesla
176962cff7fd1726db08ef313eae338fbadcdcac32db1ef02dbd24434d2b8b4c
AgentTesla
2102f5eded1e2dfd84d46563eeb6e3e78dbc99c55e3aa10bc40db3b412f5472c
AgentTesla
56e052852be73c05603cc7fee4b00a4a68d24f30cfb8b49aa4d6a68c0ad462c6
AgentTesla
63d5c6ab54621dc7cce4296d6859fff4ca1084c8d9245ed80533fde9b494d908
AgentTesla
890b1254aa61a456ab0ae233d54a095a08484ba08cb4ea83d55089559338807b
AgentTesla
8addc01173e27e282faccde8d201c4f7a95530c95525ae3290cea5e9537e6469
AgentTesla
8c9a0a56e926372480efddcbfbb5664c3c17ad8d153d997ef34f34ed1ef42542
AgentTesla
ac5ebb2296437f981009943674e53071e6154c70b2ba473f816a3fec9a42d172
AgentTesla
ecb81905b5e60f926da1cfcadaba7957862a84967debd58bcd62ea4be9f634b5
AgentTesla
+ 10'588 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-jcl7zf1bxs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 79b6263f604674cb68c8e655aff4c134e433c589f00e55861c39ad7d6b4c3008

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/375597/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/375813/

Comments