MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae693716029a02fbd7ba621099b54a85874c4f85b224e4f271ddcf8039492453. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae693716029a02fbd7ba621099b54a85874c4f85b224e4f271ddcf8039492453
SHA3-384 hash: 7ac981f61301ade848378963b2a02ebae93798c4610101be2bb2b7549e02671247dc35c7638052d75fb06f9a937c3eda
SHA1 hash: 719d8160cfb6d8801fa462c47da9be16dbfa86ea
MD5 hash: bcf2c90283102d3d58781e22ead750db
humanhash: may-yankee-maine-two
File name:TTSwiftCopy.exe_
Download: download sample
Signature AgentTesla
Create hunting rule
File size:659'968 bytes
First seen:2020-07-01 06:48:03 UTC
Last seen:2020-07-01 07:58:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:lQL1pih9FM7JJatRe7jgw9uOoqgTEgSQGSyiklfElZKIZx8U4qb87WUEt:2L1qWlktRewwJYSQA4Zhp
Threatray 10'823 similar samples on MalwareBazaar
TLSH 39E4F82A3A85E504D93D193784EE199077B1A5832B23CB0F7E89975C6E027DF3F0725A
Reporter oppimaniac
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17596/
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.13045.3901.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ae693716029a02fbd7ba621099b54a85874c4f85b224e4f271ddcf8039492453/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 06:49:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vzutofqctibpxv52miijtnkkqwduyt4fwisoj4tr3xhyaokjerjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
312ca2779ca2502a35fa0de2215e9ada5965a55896842f0c7d6742b8989d50f3
AgentTesla
3e3d152759cbe2a09c5d88af90483638866ae67101b7094816248c739d0917b2
AgentTesla
48712d577e05014edb911b241b47d008fff6907920e41146f7c9a66a1f8ff52a
AgentTesla
653f9230a0dfc61996a0213363c938cc629fe374f877febd3df485369d1f476a
AgentTesla
6b289f4c862c4205a7debaa7217dfad7e66b56dcd3274e9b4ee530aa0e380037
AgentTesla
99535a8b12db678efeb6aaab7bdc23c5cc8b1b258c42710978bb08b9ab719b7e
AgentTesla
9ffa59aeebd84a04a653520a8ac1258028c0eeb7ba4b20aa36ed63d03387b666
AgentTesla
a055ab122f92c1f247a58260073621af704a77eb41a7300fcc863b3b4754e3db
AgentTesla
cc764009f2970de6acb84a66e9a21b4d854d92aeee5364ffe513bdcb542bdd7e
AgentTesla
e84e5b011762b61f9bed2e092650249c28229411f83287d1589669aeefa0b6cd
AgentTesla
+ 10'813 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200701-h9wa94r9w2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run entry to start application
Loads dropped DLL
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/17596/

Comments