MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0298f2c494e4aca576da8b4c7cabc07e70a9d34f8d736e62ef0f506476a2a304. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0298f2c494e4aca576da8b4c7cabc07e70a9d34f8d736e62ef0f506476a2a304
SHA3-384 hash: 3b4e4c11299f3f9e06709fdc66187db6e532443347d40ce4e8d5cc5df0d5395d8699605ccebe3624d5c97c81bea067d5
SHA1 hash: ec3f981af54a4e0ab7c1054d2af005f525fbbc42
MD5 hash: 2d993c81cf5bf33efbf481e7b296fcdd
humanhash: stream-alanine-quiet-oregon
File name:gpt.alarmasystems.ru_wp_content_themes_twentysixteen_inc__buk.exe.malw
Download: download sample
Signature AgentTesla
Create hunting rule
File size:284'160 bytes
First seen:2020-06-17 02:22:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 3072:AxcMG9DPrsPhs9QYsE2vVczsDi0bd/HCsQuUcl0nYn7U8i0rNN/gACvtKD483827:S5CDTas9MA0xyYeCHnM8s26D6r6p+
Threatray 10'597 similar samples on MalwareBazaar
TLSH E254296D2B48BA02F63D193349E2267053F1D1834E11D74F6EC41FFCAA5B7CA694A392
Reporter ov3rflow1
Tags:AgentTesla malw

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18997/
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 23:44:00 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=akmpfreu4swkk5w2rnghzk6apzyktu2prvzw4yxpb5igi5vcumca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0471b3fae6b442df8ec3b595b5d090527127d3b9a75eb0f12f3e5647d03256c5
AgentTesla
0fd4a7637d3902f75001c80d8d6baf6b6efcb0c48fb51c5d170d7b6da01e86f0
AgentTesla
1cc84d3c06c9a283218310ac6d69e7161fd7605339b78035747c6f51021475ff
AgentTesla
3dc5c8e233e9889ee972466520a8db5a57b8482a01803d3870e2ec6aa33fdfdc
AgentTesla
4163f850032d58f8df3a47be1173ff7ff5d89c989512bd08979e724261994345
AgentTesla
488f6d96266434b8a189858b20fc315242d390c0c0b50ca62c9571194f75fcf0
AgentTesla
70b1ba0ece1eaa61f8946de73d8528caff86b5255ba2fe05e15f5b507db5c8fc
AgentTesla
c4334a9705c68f8d7da1cfb86e1b8f54fa3133d7937f356ea9d581b814aa18b8
AgentTesla
d5683e9201b5e1962693f4fd6d5485a553ed8537c6956c6bfed7d040d20069f0
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
+ 10'587 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/200624-px6g61cwcx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/394862/
Cape
Cape
https://www.capesandbox.com/analysis/18997/

Comments