MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a08005202c9ef8e303347f938d73e2bcc58548a5b8904f9d242f31d7b868b725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a08005202c9ef8e303347f938d73e2bcc58548a5b8904f9d242f31d7b868b725
SHA3-384 hash: a640db20a8963a16408415b2be7224cb3dc7494054ee2e6e26bd0b297dcdfe74549f6e491ac0c2b6cecabf8f7fc1bc40
SHA1 hash: 278c161e460741e40045c0f6346a0a2024f33b3f
MD5 hash: 07b30a3f7fad00f1d51a79dfbd8436f2
humanhash: paris-lithium-grey-pip
File name:QUOTATION.r00.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'144 bytes
First seen:2020-06-29 16:53:06 UTC
Last seen:2020-06-30 02:05:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:9d56a7idy1l43rpba9n+idHi09N7PA9PJ:9d17idy1larWn+EiyP6J
Threatray 10'692 similar samples on MalwareBazaar
TLSH 9DA4012072DC6F67DABD97FA44F1855017B2B9AB2023E31DEDC1B0DE1A62F910A41E17
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
4
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/16493/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WOR.18336.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a08005202c9ef8e303347f938d73e2bcc58548a5b8904f9d242f31d7b868b725/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 16:52:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucaakibmt34ogazup6jy247cxtcyksffxcie7hjef4y5podiw4sq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
11798aa5516a8f71c584946859498678274b20ad961bfabe8d65049457915c5d
AgentTesla
151fd7b3871f007957de4aa59048b9a25a68784f0d7e4e77e9ee6f26f1256702
AgentTesla
2bff0b840707457db9933a7ec8657216c9321fb18d9515371a9fabca227aabe7
AgentTesla
5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f
AgentTesla
617d412ea96ae9c5d0934c714a811b839015e763c2731879dad2cb998336a3fb
AgentTesla
634b35f814ecb44977e2e9f0e34d83ad96d336ccc87bdecf703f1e0c44a2c69c
AgentTesla
6fee5f036747f42839ee7df45c9f6480c9a5e7f3eddd546638f26858b2dc2276
AgentTesla
81534a23f49b6824f8330f9e4943dcfcc6b4acc6ff71b31d729aaa889ec72083
AgentTesla
d63ecbdde4826682339433f43e0cbdfcea27166df3be281c627edac8b30eb161
AgentTesla
ee40db183a9f86ee97dd3803b54d1711d443d25beb0160fd89cd54ad890b8485
AgentTesla
+ 10'682 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200629-e3hwj76cmn/
Behaviour
Suspicious use of WriteProcessMemory
Modifies registry key
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Drops file in Drivers directory
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/16493/

Comments