MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b85a9086885c1a043a736a81515e52f0423c1c51ef811add053f7bbf818ca093. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b85a9086885c1a043a736a81515e52f0423c1c51ef811add053f7bbf818ca093
SHA3-384 hash: a2d070258611b7f0762a7026e49f2552bd9f8b22f2738179aa9d54b0c5bc8bbaa0a37f57e67281d109ff820a76c99976
SHA1 hash: 3ead0eaa1e47daa997babf3c460ae979aead26ab
MD5 hash: b31915d218f04c3aa9e24a5086fa2c81
humanhash: emma-avocado-nevada-saturn
File name:b31915d218f04c3aa9e24a5086fa2c81.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:287'232 bytes
First seen:2020-07-01 17:07:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:5ezXy1xKwVb+WMPjyjnugrmfJFT65Hkilr1/J0c4/iK2Px/MDwNjx/T7YJG7gKsh:Iry1fME8FW/v0cmt+dNj4KGB9os1
Threatray 10'738 similar samples on MalwareBazaar
TLSH 64543BAD2B88BD02F23D1D3245D6172413B1D4978B12D34F6FC40FE8AF617DA6A5A2C6
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
terminal6.veeblehosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17723/
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b85a9086885c1a043a736a81515e52f0423c1c51ef811add053f7bbf818ca093/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 16:19:39 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbnjbbuilqnaiottnkavcxss6bbdyhcr56arvxifh5537ammucjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0990adca1040623b26949013a7d719f6dbb8ac9e4e48d28d59833c7220cb2ce2
AgentTesla
24d5ae18d6995c5afcb2ba03c90cbebde633c69c5f3a5f1fa157c1d4fcd84928
AgentTesla
3ff12e5656da20f43c70d051b320420da82d2fcecdb5ea2c7acd2d6eb7ec24f6
AgentTesla
4b39ed56a899903cbd374bcd89ed4020245530d1ccbac71a7e44a9218fa78aca
AgentTesla
4bf95223a897fa6ab4bda57ba941ecedb120c3e0a8564900f4142596e3414585
AgentTesla
50946bb2be1a9fb71dfd068710893588bfcbeacdf2cde3e0270c2f6487594a99
AgentTesla
84dff6eb89c701ad58ea9986ee5aca8065b7ebfd0b28f70a153ca45b238970d3
AgentTesla
86339324135e2584d960711e0adad1563fe4d577ff72a5f0a715b8e1768ae69f
AgentTesla
b598c7c48f10c889b428a265396073f9ae33717566c1fae28c9a8d83406e3573
AgentTesla
ea2e7ec387cf91e0ad3d44c01b25adc702061e93b66d21f8b3dd1eab812045f9
AgentTesla
+ 10'728 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200701-zd7ft192xa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe b85a9086885c1a043a736a81515e52f0423c1c51ef811add053f7bbf818ca093

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/406825/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/17723/

Comments