MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8968bfb9319f3bffbc742c99a60acf9dcc47c24eaf92ce5d5c8233807093df8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8968bfb9319f3bffbc742c99a60acf9dcc47c24eaf92ce5d5c8233807093df8
SHA3-384 hash: 8f801eef2cdd596f59150fa2823694b5f862cbdded53eebcf59a12f106e7b2844f7e08171d4bc07027dcbbf9602b5207
SHA1 hash: e9dbea564daca336fc421166f34972106ffc9f62
MD5 hash: b081d5ee00ad26ae8b05c4c9f0d23f01
humanhash: neptune-blue-nevada-sodium
File name:Doc#662020094753525736.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'901'376 bytes
First seen:2020-06-08 08:10:21 UTC
Last seen:2020-06-10 11:57:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 98304:H94k61do1a70cVItNYlJv84Efm5d+HH+3FCnXPKwQSUXmRCbTzq:dH61EawSkC8KIHeuKwrU22z
Threatray 10'899 similar samples on MalwareBazaar
TLSH 90360127294C9472DF3C473E009149C492F15D8A25C9F61F27B86E7CCA3E6962E0FA5E
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6957/
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.19181.12957.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 08:12:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xclix64tdhz3766hilezuyfm7homi7be5l4szzovzartqbyjhx4a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07cad509cf5a4ee6406a4229fe21bfaf23101816b2328402f86bc3b9e8c47d44
AgentTesla
0aa2db35de27670d6ab38b3e054ad0fa5fb46750c2ec32f5fde3a56b9485a103
AgentTesla
4787bd2bbbc1a97f0c3e3b5ae88bf23e9843271eb4badb9332fea81def56e5b1
AgentTesla
5bf9c6dd99a8c7ee59efcf09ff2b4ee5b5f51aab9ad91cd2aa0fca4b0ae975ba
AgentTesla
6eb63858afa241915034f0e38ef048db360a6a1af4cd1a2f10f26de9712805c5
AgentTesla
a70fef725d796b5adb74d12567424fe976af6539cc49d7c0fb9cfbf5812edb03
AgentTesla
d736600bb69d2649cb7d8e7df884063266fb9d0ae97e284b038c80563e7df645
AgentTesla
e1edaeafb526cd694a3f293cf47ad4bdb832cc0c6d697a1f386d0f9b63dcd152
AgentTesla
e42fe9ce657b9eedca1497cbcecfb3a6b7ed453ff5dde6c4cc3f06cdf7b59b00
AgentTesla
efe9be78a8da440c576162c8bd5498972ec6134b4276c05acb6a3b060a4013bb
AgentTesla
+ 10'889 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla agilenet keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-kl29hlta7j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9c78b036fd9c21ed034df97fe6cc1ade3137f36e5edf22e1e9e2e808d028335c

AgentTesla

Executable exe b8968bfb9319f3bffbc742c99a60acf9dcc47c24eaf92ce5d5c8233807093df8

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9c78b036fd9c21ed034df97fe6cc1ade3137f36e5edf22e1e9e2e808d028335c
Cape
Cape
https://www.capesandbox.com/analysis/6957/

Comments