MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89993eb9681800f95677c6b6770607a657bfcd06c2b6d606c7174c9eaa13d587. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89993eb9681800f95677c6b6770607a657bfcd06c2b6d606c7174c9eaa13d587
SHA3-384 hash: c0436f6ef49318e1f65d46b5c52a9f2051b786dfc7eb42e074462599a647320e8aa36df73be0312c7e3492ddd2bc6ae4
SHA1 hash: 0858c9f886a862b679c6b87ca4caa5de34dfce23
MD5 hash: 046f191e3f6f02355c11497ca287d768
humanhash: california-maine-may-utah
File name:046f191e3f6f02355c11497ca287d768.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:648'704 bytes
First seen:2020-08-05 14:00:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:WrfNQ//eBU4F/8Otzd5qdr0Wl+GmnedESM5JdvC:i/XLBqJZmkENJdv
Threatray 10'765 similar samples on MalwareBazaar
TLSH E2D45BC7B440348DF8DE827BB9A94E27E9D68D5F0903190252713F50BFBEA8667C0E59
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Win.Malware.Cnar-7194164-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/411364
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 258012 Sample: FNDk2ykE6i.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Yara detected AgentTesla 2->49 51 Yara detected AntiVM_3 2->51 53 2 other signatures 2->53 6 FNDk2ykE6i.exe 3 2->6         started        10 aKHSZS.exe 3 2->10         started        12 aKHSZS.exe 2 2->12         started        process3 file4 23 C:\Users\user\AppData\...\FNDk2ykE6i.exe.log, ASCII 6->23 dropped 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 6->55 57 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->57 59 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->59 61 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 6->61 14 FNDk2ykE6i.exe 2 7 6->14         started        63 Machine Learning detection for dropped file 10->63 65 Injects a PE file into a foreign processes 10->65 19 aKHSZS.exe 4 10->19         started        21 aKHSZS.exe 12->21         started        signatures5 process6 dnsIp7 29 smtp.yandex.ru 77.88.21.158, 49754, 49755, 49757 YANDEXRU Russian Federation 14->29 31 smtp.yandex.com 14->31 25 C:\Users\user\AppData\Roaming\...\aKHSZS.exe, PE32 14->25 dropped 27 C:\Users\user\...\aKHSZS.exe:Zone.Identifier, ASCII 14->27 dropped 35 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->35 37 Installs a global keyboard hook 14->37 33 smtp.yandex.com 19->33 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->39 41 Tries to steal Mail credentials (via file access) 19->41 43 Tries to harvest and steal ftp login credentials 19->43 45 Tries to harvest and steal browser information (history, passwords, etc) 19->45 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89993eb9681800f95677c6b6770607a657bfcd06c2b6d606c7174c9eaa13d587/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 14:01:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rgmt5olidaapsvtxy23hobqhuzl37tigyk3nmbwhc5gj5kqt2wdq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0557646805d712ca2f91d47d8cb95a292b611886903e6824f3948182228ef750
AgentTesla
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
52d7bfc971d3f5909eed410680570736d02dc79f93b42e1627a78597205ef862
AgentTesla
5a023b9d4e63aab62c95820c69b08fc286f1ff99f7eb9381c5a83b258784063f
AgentTesla
6b24da236543d38133dc41cadcf3dea51bc290479b3d669031a2c8668a620648
AgentTesla
7a9985a79a8d09029791875e5cdadd03e187d6de041ef726686450dffd42d394
AgentTesla
ad7db1393e62d89dcb0039aa5ba64a897e88d3f6b76d146ccf419e952e57c317
AgentTesla
d9f4c10febc99ea723d7f3f13d92be6bd54fc18eab233e5b28c5bcff0f3c1e1e
AgentTesla
e72bbdfcc56339eb2aca00e01162d7fdd1004d9992150f2dea1b014d6b4469ac
AgentTesla
e83175d7d56084e7dde32b39f8d113f91ee1834890222dde4f987236a88b4165
AgentTesla
+ 10'755 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer evasion persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200805-gjx28r2zn6/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Reads user/profile data of web browsers
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89993eb9681800f95677c6b6770607a657bfcd06c2b6d606c7174c9eaa13d587

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/39676/

Comments