MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 020b7a8bc9672971337dabfbbd1950c8f03848b6188ad81509b1fbe968d5976e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 11
| SHA256 hash: | 020b7a8bc9672971337dabfbbd1950c8f03848b6188ad81509b1fbe968d5976e |
|---|---|
| SHA3-384 hash: | a89ab5e1da0df7fa399d8ea458bdff874e59f0e48f37415613c07a94c2b97fbc71ea6a07c73878afbbe2445d07ba027e |
| SHA1 hash: | 07f50c3c2ad306b74ac7c60b494e5662d6b83498 |
| MD5 hash: | 6d6443a2e1c9b7d1bb8138ecc1e5338c |
| humanhash: | autumn-carpet-jersey-video |
| File name: | contract invoice.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 904'704 bytes |
| First seen: | 2022-07-13 11:11:00 UTC |
| Last seen: | 2022-07-13 12:14:41 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:o/gVXmAmjm1ge8Iojjm9kGwfMwEp8FT19vuKw0iM1ZLxZasx/K+Al7q+WulRjtGY:SAnF2bM5UJ1lDasxyhFFsNa |
| Threatray | 18'823 similar samples on MalwareBazaar |
| TLSH | T17615F11AFF6ACE61C2581B36C5FB0B44177447B6D312EF8F2BE502652C033A76D82A95 |
| TrID | 64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | 18a219d4d4198a10 (20 x AgentTesla, 12 x Formbook, 10 x SnakeKeylogger) |
| Reporter |  TeamDreier |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
anti-vm packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Detection:
agenttesla
Threat name:
Win32.Trojan.Taskun
Status:
Malicious
First seen:
2022-07-12 14:51:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 18'813 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger persistence spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
80a80d51cb2db006b1b09afca4bf426e060e0c0c29ac4d71d14ca0d7caeba896
MD5 hash:
b6a794af7417d46866072bb2aed1bc8e
SHA1 hash:
e41a6f374f92607b496bb16329e77641053c0da2
SH256 hash:
f7b07e0bdf0239a47bcfd4fb23987813cb24e8d83b173e9b3581b18829571914
MD5 hash:
9bcefa61d68aee17ec7814d64202bf22
SHA1 hash:
d6d105cd041b7b90015488b0f4d04575bac96f2e
SH256 hash:
42b6933be0fe87b7c1a189cd4af91d2007e603645c74016f2f1c3c1150f5eec1
MD5 hash:
84bf50d375740ffcc7f36ec4857cbe1b
SHA1 hash:
d54bf56ee75a613539af7c6cc91d120708bb7afc
SH256 hash:
883b63ef84c6b1cc09687962beca56e4f4b7960df7c5459e29998befaa3ccf15
MD5 hash:
ecb3f27eb8279c51608c8ea8f8050655
SHA1 hash:
82385d75444ab5fccacf37e2746c7dce73faa7f3
SH256 hash:
b13976488d58387b5d72b6ab3acd505641bb8661d7fd83827e71db364a6ff4b6
MD5 hash:
4e2b3ad4ec086892c344d746ad07b82f
SHA1 hash:
c21cf8677bb58062c7bf756e1097163f7b5262e1
SH256 hash:
020b7a8bc9672971337dabfbbd1950c8f03848b6188ad81509b1fbe968d5976e
MD5 hash:
6d6443a2e1c9b7d1bb8138ecc1e5338c
SHA1 hash:
07f50c3c2ad306b74ac7c60b494e5662d6b83498
Malware family:
AgentTesla.v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.