MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d90df049d42eb12b0bf2492d413185865d70cebfc3c8c7ad1f8f18c64b0368b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	d90df049d42eb12b0bf2492d413185865d70cebfc3c8c7ad1f8f18c64b0368b1
SHA3-384 hash:	432e340d0af091f3e2c7aa426b343f066e6a8f54e556656878cca54825fbb0174dcc87b74dd150df3b2d60a8802b3a15
SHA1 hash:	07ad1c2fcd8ca15a6b400176caf5a4c6cc5bdb6f
MD5 hash:	09fca805b4f1bebaf7b72bec81e2ae53
humanhash:	august-video-eleven-three
File name:	114245298645.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	642'560 bytes
First seen:	2020-07-28 14:14:25 UTC
Last seen:	2020-07-28 15:01:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:csSiiSSCiY4YgP5AjfPQgF9WrOsQUCxTcj6t5HHe01hHtHcpCDZMnTg6qUfR+lo:KAjfP9WrBiTcI9H1H8kDY90K
Threatray	10'614 similar samples on MalwareBazaar
TLSH	13D4F31166A4471FC66786B47067C0F00223ED95EB61DA3B8DCFEC8739E26F8A583653
Reporter	abuse_ch
Tags:	AgentTesla Endurance exe

abuse_ch

Malspam distributing AgentTesla:

HELO: qproxy4-pub.mail.unifiedlayer.com
Sending IP: 66.147.248.250
From: Neeraj Kumar <prasanjeet@natpest.com>
Subject: Inquiry
Attachment: 114245298645.gz (contains "114245298645.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/33772/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.52666.25435.30414.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Forced shutdown of a system process

Unauthorized injection to a system process

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/400540

Signature

Antivirus / Scanner detection for submitted sample

Binary contains a suspicious time stamp

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/d90df049d42eb12b0bf2492d413185865d70cebfc3c8c7ad1f8f18c64b0368b1/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-28 14:16:07 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3eg7asouf2yswc7sjewucmmfqzoxbtv7ypempli7r4mmmsydncyq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

16236af6a2deae7c6767f5f5ea20c3a485bd8d2ca966e9f861b711852ec6bf62

AgentTesla

51237c62c155f360275e53df80a26f4aa63afa7ef06301b6f1c5fc351b75a773

AgentTesla

64f7bf557a8d08ac4413dd84943cd7faca729c4f3242ced84c255202d733955e

AgentTesla

65e0630089d9a4c4deff7f1f60506c51553e140788526ea407a4b7a170224407

AgentTesla

6a22fcda5e8d0b7f62e48d79c4754fed28a38a9f1d2b232d771f1e0bdbd3ef6f

AgentTesla

6c5b87a10bf9ab9ed23a624c35959fdc7d95ad725b9d271f64996544bd7ccee8

AgentTesla

9c5a33f434a06a68d045df0070f21738d9b2f70aa3900096eef9b1faa42a5271

AgentTesla

c637a2c035da6eb31a7434fbe3e6a7a98b44d396307aa3710d3c24e9d10300f5

AgentTesla

cb34ccb02de1a3e7fd00c16fd98d509226567c084fa36aad7267fb961b9775a9

AgentTesla

+ 10'604 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200728-8xq1jppjmx/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d90df049d42eb12b0bf2492d413185865d70cebfc3c8c7ad1f8f18c64b0368b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar