MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 00c0720db185618e9ce9f91b819fcd1c2dfdc909fb4c3eeb224ad83d2551abb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 00c0720db185618e9ce9f91b819fcd1c2dfdc909fb4c3eeb224ad83d2551abb2 |
|---|---|
| SHA3-384 hash: | c022360c1b6967065b4ff907d8bae5832ba444edc3ebeb2a886e07fda31f98ee6e1bf08f26ba83c5a3d7f67d30a27192 |
| SHA1 hash: | ef14e67d4108b90f75d9b3fd2eb7f81a19d22bb3 |
| MD5 hash: | fa6ab169c3da99ccb2cdaa7251babeac |
| humanhash: | indigo-hamper-king-timing |
| File name: | PLG.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 566'784 bytes |
| First seen: | 2020-09-25 16:16:38 UTC |
| Last seen: | 2020-09-25 16:38:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 6144:GVULHGE5IqXcpxZ1xPXj+GiyoESj9QWjFST6fNRw2WABakFJaKeUbSmlokfXMJr+:TgSjWWjFSOfZratqoSXoe6gxxHK |
| Threatray | 172 similar samples on MalwareBazaar |
| TLSH | C6C4CF2436E44B15E0BE8B75483D1C6407FBB9058632FE29FE9C74B90B3BB909912F59 |
| Reporter |  James_inthe_box |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-09-25 16:16:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 29 (72.41%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
spyware
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
00c0720db185618e9ce9f91b819fcd1c2dfdc909fb4c3eeb224ad83d2551abb2
MD5 hash:
fa6ab169c3da99ccb2cdaa7251babeac
SHA1 hash:
ef14e67d4108b90f75d9b3fd2eb7f81a19d22bb3
SH256 hash:
b09f492049a9fb45a59daf2424bfdcf61622e27282352173e524e909330be91c
MD5 hash:
bf9a41e800fa6bbd5b732ade6e74788e
SHA1 hash:
4988cdb013367e15b65e8cf14f8a71f51aa56d2e
SH256 hash:
f12d3f0e7facb1d870dac37cab6ebf45a350801fe99a8e412d818a336222a445
MD5 hash:
415896f60740fa2413103a705fb22096
SHA1 hash:
4d7082ad0578730e21da5f64acbe7f0e415c1c57
SH256 hash:
35841996897062e4877083a63456340d37f952e226b78cb01c765960369002a0
MD5 hash:
1168fc89236e652655041ce2a09fcd9a
SHA1 hash:
785085d391e268fcffeaee9ca3592045b3538e11
SH256 hash:
f91136b3f9578e4787485acb78c2e8426f29b2b53137f30b9da2ddef7f1aa0d2
MD5 hash:
5540aa958af14cc012e560ae882105e2
SHA1 hash:
934fed584590da075b3119b23fc3a67de85588a5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.