MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e950895f2f16be6fbdb0f07542b980f06bb42e63ccde9a583d55e606d8b56d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e950895f2f16be6fbdb0f07542b980f06bb42e63ccde9a583d55e606d8b56d1b
SHA3-384 hash: 441b3506d88a859f3370cfcc55b0bb5add9c45d9c96a5aaffbd2c73d4834676afbf7ebed97bc3e358fc4da210e8bbade
SHA1 hash: e30eb905440c1246411915277c26c99d1a57e501
MD5 hash: 0597979ee77c617912e1e687e8cb3572
humanhash: may-alaska-fanta-moon
File name:Order Inquiry Quotation.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:653'824 bytes
First seen:2020-08-18 16:00:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:kEKdAm2dvF783/PMHi8w4Qr7gU7WVQQ3gs9dUw3N:GQ183/POiCO71W3bUw3
Threatray 30 similar samples on MalwareBazaar
TLSH 4AD412283AD8AB28E43E573D9625055893F2A207C736E70EBEC955BD08B7F4187D2347
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47958/
Detection(s):
SecuriteInfo.com.generic.ml.20063.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the Windows subdirectories
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e950895f2f16be6fbdb0f07542b980f06bb42e63ccde9a583d55e606d8b56d1b/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 16:00:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5fiisxzpc27g7pnq6b2ufoma6bv3iltdztpjuwb5kxtanwfvnunq._file
Verdict:
suspicious
Similar samples:
1c2894353e85e78ce3f7d55ce6ef7422e5ddcc52dfa1a92bbe6808c01228e57e
AgentTesla
40320b0e68eab85d1bedae171c4f0bbafd5bb19059038121247229c2186a66ec
AgentTesla
484e5bc2876eee8716634dbdb497aa5df345e2a489a6c75f8ec2acbb4bbdc0be
AgentTesla
855e85de489ded4ca8e543cb8323c2d91e88c0e9d6ffe1c490f6133190c4d6c5
AgentTesla
889352094880e37d9fb8d07ca965839f595ac5b821996f4290149d1815981a7b
AgentTesla
a7ec6dfb09d3866bdfe3a1306182ad995f309029828f9e1de99bb7f658cacb64
AgentTesla
b0fade864cb32de9110f513837a4e6b59e39ac4bf8bd7a3e0fbf54c305e4d006
AgentTesla
ccc7d187ff725af5867b1358f3324be6155de93ce81079564d1fa22bac501702
AgentTesla
e38a459f721050cdc6779172eeda9caa5496f144e41fce503ca01554ada0a64c
AgentTesla
fc87f06a5699c35bd0fd808b51c0b0558f112e5bb0158d7553a07456d3cd4ffc
AgentTesla
+ 20 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200818-wbk9r97j56/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e950895f2f16be6fbdb0f07542b980f06bb42e63ccde9a583d55e606d8b56d1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/47958/

Comments