MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4937d194c3d4094a635c91739d9d8721614a9a7b0a254608890cfc09e6b4c2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4937d194c3d4094a635c91739d9d8721614a9a7b0a254608890cfc09e6b4c2f
SHA3-384 hash: 6a75c639e3dcc806b8e4093f40360ef252ce4403d6dc5972d14f571dbea24ce0da7a4839aaa744597a926c276a0738be
SHA1 hash: 493322db972f1dea246bf5494cb2a8bb5d0eddce
MD5 hash: 4d252fea9c537d2b2fb6450f1d2669ef
humanhash: undress-april-colorado-maine
File name:2XSgu1f
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'436'672 bytes
First seen:2020-06-03 09:40:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:vtb20pkaCqT5TBWgNQ7abakiqrx+folCXGizMvNb+1UGQ3ea6A:sVg5tQ7abakBE+YNzMvVAUGg55
Threatray 10'985 similar samples on MalwareBazaar
TLSH A665E02363DD8361C3B25273BA25B741AEBF782506B1F96B1FD4093DB920122525EB73
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 19:11:52 UTC
AV detection:
19 of 30 (63.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsjx2gkmhvajjjrvzelttwoyoilbjknhwcrfiyeisdh4bhtljqxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e52eae0d858b4fcdd21d5ffcc013da8706adda92afbb791e704556362b8f19c
AgentTesla
23879e67a3fac6f140a8cf297db67d52ae7f1bd88c7f1e764b56e407d63caa58
AgentTesla
3415b00698070382206702b57a7312c1eeba1f33aff4a02511eeb0fd9ce002c6
AgentTesla
4ae35102bc33590c30b02786e524e62fa006f6ca763af96996f8d9ba4cad7bea
AgentTesla
b1e3bb6b48df665d704ac56965d6bb5ee8839fd28894055cf40ff6dfbee974d5
AgentTesla
b78e0ed795cb86a85ec771f41d364d584b46fefcf84a5151e92d017334b5ab94
AgentTesla
b98f6ad80f1ab3459c9e3626b1113eba28dcc4d07f696daee1050a884900fd80
AgentTesla
c4955f8d603c6accc10f0047de011fca440c4aa01667a67023982bdc00eff612
AgentTesla
e1cf5aa9e3ec6127ed25375257182ea313abc3a1348adf98c977a60164a0aec2
AgentTesla
f0e064586cd92b27c56186938d863ff79d43b44891f5782cf7a9e23e8691ce25
AgentTesla
+ 10'975 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-jl16pvjp6x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Word file doc c4955f8d603c6accc10f0047de011fca440c4aa01667a67023982bdc00eff612

AgentTesla

Executable exe b4937d194c3d4094a635c91739d9d8721614a9a7b0a254608890cfc09e6b4c2f

(this sample)

  
Dropped by
MD5 2d84eeb3ec6b6941c4bda5d6f004df93
  
Dropped by
SHA256 c4955f8d603c6accc10f0047de011fca440c4aa01667a67023982bdc00eff612
  
Delivery method
Distributed via e-mail attachment

Comments