MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c0886ce75459bea4b08f95a82f88f101247b7baf66b44f930e46d111240542f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c0886ce75459bea4b08f95a82f88f101247b7baf66b44f930e46d111240542f
SHA3-384 hash: dde79a65d225036d8404a5ffb88f1b33f552c4586fc7d823e67dd56ad7b9d8c2e6f27854163a787a72c9121528cb600e
SHA1 hash: b1785d097980a88e75c741295d5e41d95d6acd81
MD5 hash: 4c47449732d4a12867f22d318c049591
humanhash: louisiana-angel-leopard-maine
File name:4c47449732d4a12867f22d318c049591.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:575'488 bytes
First seen:2020-07-30 07:04:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:kkpMhTmOon5A+tcCTVDTtkwIGINwkcLoXggOd2:zgTmJ5fWclTtk5GIi1LoXgL4
Threatray 100 similar samples on MalwareBazaar
TLSH 03C4CF59B694ED1AC7FF4174E1DC1628CEFCC092912FE389681593EB2AC63B3D5052B2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.gammavilla.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35314/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/403212
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7c0886ce75459bea4b08f95a82f88f101247b7baf66b44f930e46d111240542f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 16:04:49 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqeinttviwn6usyi7fnif6epcajepn526zvuj6jq4rwrcesakqxq._file
Verdict:
unknown
Similar samples:
0ffe3a2c15dd0469d00b515316cdf09ae0e6b4dbbffe106297cf7f7d0d1b8197
AgentTesla
1d14146ac003de2500950e2c52878e7c8866b107c0de95aaceee7e08d596acd7
AgentTesla
2f6f668a34430c631a8655e4bdd5792b0dc16b13a7e8f447c185d2c4216f81c5
AgentTesla
320b9847b87acc72f35b69c9767584a8627d6cce512d65d45ca5bbc62b94230e
AgentTesla
53bbb4302f38c9d4967a01008ae1e923ebd86facf3dba84e16be50103ca1608e
AgentTesla
5693fc15c7c4843819dd2e7d768f7ad32c031ca0a112cf604d38319d00e7a811
AgentTesla
9649094a155e904fc28617746d9656d499d04da6944e5201fa322bd1cbe1a897
AgentTesla
a72abccbb65d45e50e2bdac6fbfcc3832af2be5e8bb2c20904674b8e59fc667c
AgentTesla
b5e119f0129ab5b3b65cb24a241a2dbea720b80f12afd7a378a614c908dbe325
AgentTesla
be1c09c070130dea908df866febc1f792e0afd0754f1c3e096ef23fccd58b394
AgentTesla
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/200730-e359s5emta/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c0886ce75459bea4b08f95a82f88f101247b7baf66b44f930e46d111240542f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 7c0886ce75459bea4b08f95a82f88f101247b7baf66b44f930e46d111240542f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/421788/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/35314/

Comments