MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3afdbf1c149216584a25199682ffd2882fdd23b08c6ebbb3078ad1ab05d35ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3afdbf1c149216584a25199682ffd2882fdd23b08c6ebbb3078ad1ab05d35ac
SHA3-384 hash: 86b0b86498fee088ae1c10b0e75f0d80b022c19764abfa2345d51e3aff3659a2ab32aa0cb444e5c81c0d37a5ed5813fc
SHA1 hash: e1ff1c266290c32c3cb4e401ef25a42cbc4e4f3a
MD5 hash: 0762fa69a3f7379bf7176934ca1e4856
humanhash: wyoming-london-arizona-minnesota
File name:BALANCE_PAYMENT_IN_EXCEL._SIZM0071304.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:773'632 bytes
First seen:2020-04-30 07:26:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d4dc0840b1f7d56de308c9e17856cf7 (1 x AgentTesla)
ssdeep 12288:PUetRPzIfT47tVpRGjzceKGjsbc1M1vXDHfeAz+naJOKXkRc:1Vz9tVGkajZ1a7/eArOKXkS
Threatray 11'011 similar samples on MalwareBazaar
TLSH 1BF49E27F2F08A37C2771678BD4B67A56839FD002A2859562FF41C484F396823F6B197
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Eaal-7012353-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2019-07-04 10:16:34 UTC
File Type:
PE (Exe)
Extracted files:
133
AV detection:
43 of 47 (91.49%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0b4b14bc3a05f06113b88f9a389517f497309b1609fa8d24d337fa4899def582
AgentTesla
22165d0974fa72f7e87c8e5128cd1fc3fe6b6dc0ed8e990838229b3a92234349
AgentTesla
32ef6a3c172b8ab59ed668b0fbad8c05dda82428fb2d1ec8e47d9e6db076043f
AgentTesla
37d7cd08ca91dc9962cfd418aafc0d115b954ee72c181feaf7d986c1f56b26a7
AgentTesla
7ab75859697472c8bda10b6cb7e7ffa7c8f5ce5eae3e7c67a565ffad2c6de83b
AgentTesla
8948e4e0f392197b1c1436e5f7a2a7bc326c849b6129d8cf287a6d6a03cd642e
AgentTesla
982d2699709d7a024a542a4f771a544cf987ce8d8f15cfa3dcefca157b251e3e
AgentTesla
c94bbe19d634268f0794329f8c8a92cc9c1282a55f6a3de656858a4ed0fb80a0
AgentTesla
e0e1906cf3bdce3052f97a950aef614488f566a4d587428d64d0c848f97a7a4f
AgentTesla
f2db78e5165646f19a5b9438764740b24ab4c578890cd68e292cedaed3f7ca84
AgentTesla
+ 11'001 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments