MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a4aa8d0acefa1f81a81440379ce5c4c76175c6a28d72ab61d372394646bab6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a4aa8d0acefa1f81a81440379ce5c4c76175c6a28d72ab61d372394646bab6b
SHA3-384 hash: 448308060c14a806992658f81300efd1e879bcaadf497ba25400d80b8f718b49180bc0c541e709ddcc169017d3f0542b
SHA1 hash: 5a5b0e2730fedf43cdfb13258000b5652d554ef2
MD5 hash: 43f7d11bdf7a14a065f4958e0ff1bb2d
humanhash: potato-lithium-don-gee
File name:Shipping Documents.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:758'272 bytes
First seen:2020-07-13 22:04:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e1c1ff870c7f2916086288f794229846 (5 x AgentTesla, 4 x Loki, 2 x FormBook)
ssdeep 12288:BkXOU51w5qnnf9aG3EV+M6qzvXkqYJZ+bMM481XXrooZyi:qeMbnn7EIqzAT4MMd9Xkcyi
Threatray 11'694 similar samples on MalwareBazaar
TLSH B0F4B062F2E04833D067163E9D6B97F8583AFE41FD589A872BE41C4C9F39341782A197
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/25540/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching a service
Creating a file
Stealing user critical data
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9a4aa8d0acefa1f81a81440379ce5c4c76175c6a28d72ab61d372394646bab6b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 22:03:56 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tjfkrufm56q7qgubiqbxtts4jr3boxdkfdlsvnq5g4rzizdlvnvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0653767ae5080215ccf4d05fc78bf2c968568f847c4735279ac20f3b5ad303b4
AgentTesla
0a3c65874fe1eb6d20f08ff802ffa3cf7ec93cfe500f4440929cd5378a39e2c8
AgentTesla
0d0aaa114bac9aa0afb33e6c70959524af7afa277e7700967763c604d4d188c2
AgentTesla
3b32cb9ad3d5b8b07ad3188b3a2551498c0752079e4d95e3d790ec39beab5b5d
AgentTesla
6b0f2c8d4a8c8883be658db9868b33db30eb73755e4688279c29599eb25c6099
AgentTesla
7a3c761d105aebdfc06ce56ef43ba47d374ba81cc1d64d5380054cccbd92bd57
AgentTesla
930d653a60d5eea45cb332a3b313d8bf129c1b6a0dfa82aaedadfb9dd0dc8ced
AgentTesla
c18ae57203cb03daa5d28d11862951854656f2ce1f7d74237d3972345e7140ad
AgentTesla
e00c10de42f280a8a4cdb98618940bb9d767bc455154790ece3c265af6eaefb4
AgentTesla
ef3cbb89feca43a0f0756ff2c3e485755e38f2d4ea6f807e7c09fe31ab710920
AgentTesla
+ 11'684 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/200713-l2f4akmyze/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/25540/

Comments