MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56840640186247deee56a36d22de91915a650be338be46de501c9a6ec67d4ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	f56840640186247deee56a36d22de91915a650be338be46de501c9a6ec67d4ea
SHA3-384 hash:	5c10b44d3092a36a7adecc3bf4c8eb8ce0f535b70f12d8224cf07569b41128acb554abe4f9eac6a4dbcc145a5bec5e0b
SHA1 hash:	982c5af6b7784831bd9a28798142417358f2fec8
MD5 hash:	457de5690dbc92ae0e5e936846695dd6
humanhash:	island-hamper-juliet-emma
File name:	STATEMENTS AND OUTSTANDING AMOUNTS.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	586'752 bytes
First seen:	2020-07-13 07:29:15 UTC
Last seen:	2020-07-13 11:00:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	12288:+JTo5IXEaY1zMMbKtd+zRDiPHRP7r9r/+ppppppppppppppppppppppppppppp0G:+SaaXzRmp1q
Threatray	10'678 similar samples on MalwareBazaar
TLSH	B3C49C85E98556A0DD19AB706E36CE34C6237EFDA834A41C29DE3E273FFB3931025452
Reporter	jarumlus
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/25105/

Detection(s):

SecuriteInfo.com.LuheFihaA.27388.32291.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Using the Windows Management Instrumentation requests

Enabling autorun with Startup directory

Unauthorized injection to a system process

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/f56840640186247deee56a36d22de91915a650be338be46de501c9a6ec67d4ea/

Threat name:

ByteCode-MSIL.Infostealer.Agensla

Status:

Malicious

First seen:

2020-07-13 01:55:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6vueazabqysh33xfni3nelpjdek2muf6gof6i3pfahe2n3dh2tva._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

55dda2889a2fae3ddbe54c70a6ff687d366887a672502d00513543bb9aa482f3

AgentTesla

5e379b41c2c285ac8f0c8944b3762490f431de66b5b0c75864955aa2ee5e96ae

AgentTesla

b01fa74e309cff0ee5f5a43a9a908df88a9577d5e21fe251361fa1a89addba06

AgentTesla

c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37

AgentTesla

d0b71fdf377abca1c191fedeab8311dac158632edb66f3b894166686d61bfad6

AgentTesla

d20c64eecd1511d3fdb7621d507e9a8a1e9510ab5492480e22dfee4e2eca4941

AgentTesla

dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f

AgentTesla

f84fb6d4efc2d260e4afc8515a01646621b32a5a8e767d7f0056a3e3f0f9aacb

AgentTesla

fe200cf4827d467a2915295f0b092c7afedfc13dde1381a74bb884e2baceb44c

AgentTesla

+ 10'668 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

spyware keylogger trojan stealer family:agenttesla persistence

Link:

https://tria.ge/reports/200713-327vzlmpzx/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies registry key

Creates scheduled task(s)

Suspicious use of SetThreadContext

Adds Run entry to start application

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Drops file in Drivers directory

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	win_agent_tesla_w1 Create hunting rule
Author:	govcert_ch
Description:	Detect Agent Tesla based on common .NET code sequences

Rule name:	win_cannon_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator