MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfed9e577e9dd60180ad2570309daa91db19036c139b35e35d68e45cf38d1544. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfed9e577e9dd60180ad2570309daa91db19036c139b35e35d68e45cf38d1544
SHA3-384 hash: 0cbde5c041f54bc5f46bcd066e8affbb8059b29fa95a0270a716bf877613077abde8195634e881599c60f9a8d6df529e
SHA1 hash: a599fe45f5400db148d0299703b0fe1d12f32371
MD5 hash: 1f7264a3f7853bc9a9f3f0c138d5021f
humanhash: three-video-whiskey-ohio
File name:Updated-artwork.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:558'392 bytes
First seen:2020-06-18 09:35:39 UTC
Last seen:2020-06-18 11:00:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:9d9gMdLXT6gIrJUpArSRzjHqFR1ng304+pHPF8WsGsEFFGGy4Uq+:9vldzLpArgfKFDng3T+1HsGF7GGy4J+
Threatray 10'718 similar samples on MalwareBazaar
TLSH BEC44A59FA815445CD3D0371203E8EA4622B7EDAB878E60E2A9E73247BF31D7227714D
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19720/
Detection(s):
SecuriteInfo.com.Artemis1F7264A3F785.27593.UNOFFICIAL
Create hunting rule

Gathering data
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7wz4v36txladafnevydbhnkshnrsa3mcontly25ndsfz44ncvca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07cad509cf5a4ee6406a4229fe21bfaf23101816b2328402f86bc3b9e8c47d44
AgentTesla
38a83ed65dd375ad496b01eb7bf0f050983b1a289f1fcb01e9898fa7565ddd63
AgentTesla
472f0ec84ab48794ad55ed2bf58a37f7753c9f7b9016f07892aa5053022d67b5
AgentTesla
5ad03866532191ad60fbe707c4b6b75fffe24ff8881e627afd65780c797be9e2
AgentTesla
77682fb2cd5b31c9c8f45afa66b50e52f0f55e37a66bd6efe0ebdf10fb52b5e0
AgentTesla
90c2b20b2f904dcaeea6ca1e3a4fff5d586c3f07a0f958b3fd25202ab3a35d2c
AgentTesla
93be03ee9522ffc9ea73dcf74bac994a5eabf6f373c0536f5c718af8ff819995
AgentTesla
ad7db1393e62d89dcb0039aa5ba64a897e88d3f6b76d146ccf419e952e57c317
AgentTesla
c4e9eb2749042ee265fcf74e8f689f983ef2ca68bb11ed9c52e3c56d86eeecc4
AgentTesla
c8c4219d39faa8c727e9905b5156f4bc71c4bfbb4c9495c8a80be7020cd4380f
AgentTesla
+ 10'708 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla evasion persistence
Link:
https://tria.ge/reports/200624-wb8f91kzyj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Modifies system certificate store
Adds Run entry to start application
Reads user/profile data of local email clients
Reads data files stored by FTP clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe cfed9e577e9dd60180ad2570309daa91db19036c139b35e35d68e45cf38d1544

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/19720/

Comments