MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85d492906e185a9b5bfbe4a7396803a8ce17a655270c04ddeaa76670b239c3a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	85d492906e185a9b5bfbe4a7396803a8ce17a655270c04ddeaa76670b239c3a5
SHA3-384 hash:	c1eed5778dbcda7799edc1dce45964eecd2edfc6ab440e6fa61eb3d682403a2fdae77e0e3c1b8662ad12c28e233592bb
SHA1 hash:	d840d6e9353bf07fd9759736d80263cdf29d446f
MD5 hash:	054384c5664a8a021c3a280f71bf4430
humanhash:	two-bluebird-table-queen
File name:	statement of claim.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	511'488 bytes
First seen:	2020-07-28 05:18:53 UTC
Last seen:	2020-07-28 10:55:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:gHrYqWibfT4I1y3GXrqwq4WfHZWoFO1UPs:YHfvb5ql/ZWo
Threatray	10'598 similar samples on MalwareBazaar
TLSH	E5B4F0042600679FC317C8627867C8F04613D5AAEB66EE736C4FD59B45C91FEBAC31A2
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/33157/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.52680.13035.3294.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a window

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/399256

Signature

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/85d492906e185a9b5bfbe4a7396803a8ce17a655270c04ddeaa76670b239c3a5/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-28 01:03:00 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qxkjfedodbnjww734stts2advdhbpjsve4gajxpku5thbmrzyosq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

45b7e7e404b6cd8eaca7798b5977fe17cae6a261e45d6a0dfd39bf15d0582b60

AgentTesla

575eff9cc32b30f7b274b3868cddb645286ebb701afefa3f5a57f489da11bf01

AgentTesla

5cf1f9fd8a8000ae58fa7607a3201c6abfbc9a352d90e589ef1d93317336c881

AgentTesla

69edeb3d6fd141dcd84b1ccf4d26eaf1633bae81803b078a7b24e4f0058828f3

AgentTesla

8210f4c4fedbca54d332df8d9e672cef8a4424695c2ffce581bf526a1537be27

AgentTesla

a5efbcb25b4339ea9e004364c443afaadb86353cce9dcd9508115bda5a57be88

AgentTesla

b4ddc58acc408b2ba14056f04e2a989f229e537dc7132a48250b3565ef82ca09

AgentTesla

b6072e84d6cfb921a3fb0a38bc13e148a308b7b4158cd9102d933810ee6858ab

AgentTesla

ca85ea610b26c1c9d595cec0108697c662f5580cd9c7d3e26d227f52bb951bff

AgentTesla

+ 10'588 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200728-a8s9y4qhhx/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/85d492906e185a9b5bfbe4a7396803a8ce17a655270c04ddeaa76670b239c3a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar