MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbc907e55140d6cca7c0c4d71ed17c59b7be727ccfcaefad3f9a9f11527ebdbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbc907e55140d6cca7c0c4d71ed17c59b7be727ccfcaefad3f9a9f11527ebdbb
SHA3-384 hash: 84dcdec0ffa0b5614a5732bba9c35ef783f1ce88b7bd7cbc0b2ee4250d9692592a542db49896097d130fa9fc3ba8707a
SHA1 hash: 7708623a3b59b44236eae08b025c06b36c144375
MD5 hash: dbe9a3f4eceb73b67bb6b52e3f094933
humanhash: venus-north-equal-alabama
File name:dbe9a3f4eceb73b67bb6b52e3f094933.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:514'560 bytes
First seen:2020-06-02 17:12:47 UTC
Last seen:2020-06-02 17:34:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:9Rzz5CukMD03BrWsROAqPxSu8Wl9LH73lVnqgE6NUL7A3cWJmBe3rwckj5:9N5dkC09ox8Wl5Tno
Threatray 10'585 similar samples on MalwareBazaar
TLSH D2B49D9C766072EFC867D4729EA92C64FB5178BB831F4113942725ADEA4C887CF241F2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.platinships.net:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Packed.hc.23858.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 16:15:01 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zpeqpzkridlmzj6aytlr5ul4lg3344t4z7fo7lj7tkprcut6xw5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
011a4b06a1a31fec0e9d5a013b9721f4e30f0ec963d07c42cb1d0e41c30df389
AgentTesla
02466f6a6f4a7b3abd212c5a0b27c8e75a29c2abb19771f22e231321d40f2c39
AgentTesla
6c7624c020bb11d5803286dc0fc1d9ee44d21be97207573051bcd322091a731b
AgentTesla
6ef9a45a617adf0e0ff740e37c865325289a110394725c393c314a3128a2575f
AgentTesla
9a13981eb4fb532d207c90f4f5689d9ad4d9af29e2ddf7030d78c513330c4dbe
AgentTesla
bbaac7b3ed88de087f05eb610ef2db6aadf44c888909019173c7a449522d2bb8
AgentTesla
be823d1cf2f6d602b91ec0b226fcb8a393f15efd519ddea975a2dfc6fa348195
AgentTesla
cd301ca1c374c26aca9bf5381a3b491ae384f06868617c6c16b563213854d159
AgentTesla
fcdececb42372d5ae1a1a1d367046476f916624878980498984983f00add62ad
AgentTesla
fdcdf089f15ba0a610e2d6f0c758fffb27835bec9884126f1054764112eb1dc1
AgentTesla
+ 10'575 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-xwl88fa3ej/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe cbc907e55140d6cca7c0c4d71ed17c59b7be727ccfcaefad3f9a9f11527ebdbb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/374522/
  
Delivery method
Distributed via web download

Comments