MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c203192bf329f099fddebfc57a7a258b974550e0b51a81115c9980aff02fe6c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c203192bf329f099fddebfc57a7a258b974550e0b51a81115c9980aff02fe6c1
SHA3-384 hash: f8b37aca8f57eaac9f097ef1c3db009b7d99949132cb5c663b86f6ab9ab24e080235106343c27983e28757a645f1068a
SHA1 hash: fb349392eb590424bb48e5279bca264ea007312e
MD5 hash: ae6c8780931b088abe4f6a1fcd0c5510
humanhash: equal-winter-high-batman
File name:MoneyAlex.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:726'016 bytes
First seen:2020-04-29 19:12:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ed782f6302c265545bd218bccb052ebb (1 x AgentTesla)
ssdeep 12288:tYv3bkaNR1J9ybToLdkMjJnL/MAp2k9U0mYZJH/C:S/guR1JYSvNLUtk9UpmY
Threatray 11'057 similar samples on MalwareBazaar
TLSH A4F4AF22E2F24837D1632A7C9D1B53AC98F6BE113E28DD466BE41C4C6F79241346B397
Reporter adm1n_usa32
Tags:agent AgentTesla injector kryptik Lokibot malware

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'259
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Mal.Fareit_V.16927.15926.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-02-23 01:43:09 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yibrsk7tfhyjt7o6x7cxu6rfrolukuhawunicek4tgak74bp43aq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
50f2b41bb5e2dead969345319a9617715492e979937f0b11264f927cd007f903
AgentTesla
6c23d5aac98c05cf9faca072f1875f7fcde253a4a782dda7d897681bda6f92d9
AgentTesla
757f7141daf24169ff3694cdf0247b7ce0b71c66a970837a71149a69b5b6d371
AgentTesla
75928a9911adb30270a8d3a6585cd2e30cad897e35ce2273cc7705083074b534
AgentTesla
a72f9a0317980cebc1acdc4f89b372a09004a4fc7537f80ab0eb52b2fc94746f
AgentTesla
aa218adce0cc32486a75b6e5a2669c8b82afac444485f3d44bb168482276ad4e
AgentTesla
dab4d45b3d041bec38bb40ef34ec38a6efee4c8e582c9032f22d5bca9115c189
AgentTesla
e640fad06c4f66298aaa5e4a4beb4a210131f6799ed82a69e5db5da21ec53d7c
AgentTesla
e8435237623f073caefc83ba357864fa6ed91d7d0fee7b67db8620e3a793f47e
AgentTesla
eceaeb5dd1fdf321efcf6c4e33706e025408deaa74ece9fb0e4e145901513cf2
AgentTesla
+ 11'047 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c203192bf329f099fddebfc57a7a258b974550e0b51a81115c9980aff02fe6c1

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/317567/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments