MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7b8bcd6f7cc705aed8441cb520d1796dbc16eb4293842c32487feaaa71826fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7b8bcd6f7cc705aed8441cb520d1796dbc16eb4293842c32487feaaa71826fb
SHA3-384 hash: ec81b1b6dd2281970b858bd95a22860d9bcd767ced4bedf96638a98d6ab55b5f44da7b723124400b7cdc1ffd1572fe8a
SHA1 hash: 474def61434ae6f9d90fe7653c2957d9c04a7097
MD5 hash: 4d914fcd5c8346fe52deb8001a24386f
humanhash: indigo-eleven-friend-muppet
File name:4d914fcd5c8346fe52deb8001a24386f.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:450'048 bytes
First seen:2020-06-23 13:31:14 UTC
Last seen:2020-07-08 09:22:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:m54pBj7KgY6vVeYYjFm4mF2ICc3fCWnRMEi/:m54pd7vvvkFjY4mwgFnRnW
Threatray 10'658 similar samples on MalwareBazaar
TLSH C1A4E0443FA94B1ED26813BE1522126D137237E69A11E2DC18BBFCDD0E25F53468CAB3
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.startranslogistics.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12994/
Detection(s):
SecuriteInfo.com.Artemis63715DF92E44.17574.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a7b8bcd6f7cc705aed8441cb520d1796dbc16eb4293842c32487feaaa71826fb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 18:31:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u64lzvxxzryfv3meihfvedixs3n4c3vufe4efqzeq77kvjyye35q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b
AgentTesla
1fe9e9760604fed048445b3c79c91d30a9b1cf75a2a689c48181724a91df38e3
AgentTesla
2eebb01bf1beb78cf343f5465a600eaf0c17af2bd28a7133d41581e8fa2ee5a4
AgentTesla
41f79628a7ff72d611f593286f5b70a51c72f8359e6600535b1b3e9772fd7c0c
AgentTesla
5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350
AgentTesla
5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3
AgentTesla
6cb654eef04d1ee111df21c38103ff082fe9e035e46c036ebecc0bc21d3efd80
AgentTesla
b8816e0b814bc0528b84fe7e0e89cf5e8168b64a8028d8610510a59f3f7c2268
AgentTesla
bb398328320c76f194dc38b13275c4fe564cd0c85457fc83e62643110cfe0631
AgentTesla
e8454346c57024c395766f6c82771a58c6f03cbaa15871646cc197aae5b73461
AgentTesla
+ 10'648 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200624-b7lj9jdy9a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Adds Run entry to start application
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Drops file in Drivers directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12994/

Comments