MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 884ec2901e7bacdf6f6a84383997a8e4fd297d18009545751cef558ae726472b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 884ec2901e7bacdf6f6a84383997a8e4fd297d18009545751cef558ae726472b
SHA3-384 hash: c7ff325b07d76c9755f8dfad162714957836f551841f466e613439c03aab1d34102a831e276f003934cf45599f108370
SHA1 hash: e9866b269bce72804fb3d94776985e5c22749281
MD5 hash: 8fbc9f81eb2398e3d46b38152a7fdf21
humanhash: mango-hawaii-berlin-maine
File name:8fbc9f81eb2398e3d46b38152a7fdf21.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:714'752 bytes
First seen:2020-06-28 06:44:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:HasP6jqAdgic2iJe93BIwoo76VaFt9WwWCddLIKLtfNDT+JjJsPygVR6l:HasP6jq6giueRB5RjFt9t17DQJerR6
Threatray 10'669 similar samples on MalwareBazaar
TLSH 31E45C3E3A42B905D63D497704DA56D063B1A2833A12CB0F7DCAA76C6E067CB3B5534E
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15138/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.349.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/884ec2901e7bacdf6f6a84383997a8e4fd297d18009545751cef558ae726472b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 09:17:27 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbhmfea6pown633kqq4dtf5i4t6ss7iyackuk5i455kyvzzgi4vq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0cbc16717ef6c0d7e1d8ac2abba091925aec1b77db20cbff97407fcd5288736b
AgentTesla
573535f4daf60e724e68c766dfa8ac52bb96b33d4bbe307e36730725dd0f40b0
AgentTesla
7aa2e610774aeaede163770891fe671e27c484405eddb143631982f3cad77595
AgentTesla
9023f7b2da3424f0542a1ccf961ad9a6f55c37351cf530e8811f9875bf3a6f8d
AgentTesla
a6d44377671c37e4ef84efae15b17efbcdd03a8b5af2704e74f75126f333196f
AgentTesla
b5258ddc74fd2d455241f16d2505ab8c67b590fde3f5475be867e28c7856be07
AgentTesla
de54a16c8d1a17a0eb2b797cb1fd7604ff1607e53cfab3b05f1fc9c28f1f83b0
AgentTesla
e1ba5e7ce83caf65d32c952d6f8784aa9be74ffd8c89e3c65697060190f50298
AgentTesla
e30821af035b182de6dc8b54d9506383cd5a5713c4448faa4c842763371063b2
AgentTesla
ec766638dbd645faad5115dab7ff18b9e2afb5f4a0da724ac945ae3e50815b06
AgentTesla
+ 10'659 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200628-g5l1alabq6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15138/

Comments