MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09944e1f48bf7f92a9302b2fb104e20ede5d5a897dd2107f795175e0cfa405e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09944e1f48bf7f92a9302b2fb104e20ede5d5a897dd2107f795175e0cfa405e0
SHA3-384 hash: d0fd408e601cdc6fe312952932e288e42359e617a98dbb1de2a74b3951087c05799c31193f85ecbdb47724eeb4f29816
SHA1 hash: b39c56ff3ad31a7bb9637360147fdf9b79bb3480
MD5 hash: 5e342bc1dc995ee3216b7410cb27e5e4
humanhash: summer-shade-mockingbird-diet
File name:SecuriteInfo.com.Trojan.GenericKD.43371788.15928.30012
Download: download sample
Signature AgentTesla
Create hunting rule
File size:351'232 bytes
First seen:2020-06-23 02:29:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:FvBmoABZ5Ar3ggMYFGhRltf8z0NOcek4VR7NGBbdsa83ocgUyPC0O713:FpiBjADggMY4RHf8ZGBg3KUyKP7N
Threatray 10'630 similar samples on MalwareBazaar
TLSH 8C74D077E1B5DD6FC97416B24DF2E046AAE866D339005B8F8B005D062EAE1C949C3F36
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12776/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43371788.15928.30012.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09944e1f48bf7f92a9302b2fb104e20ede5d5a897dd2107f795175e0cfa405e0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 18:37:43 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgke4h2ix57zfkjqfmx3cbhcb3pf2wujpxjba73zkf26bt5eaxqa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07cad509cf5a4ee6406a4229fe21bfaf23101816b2328402f86bc3b9e8c47d44
AgentTesla
0d07c8344ef01c56baf0fbb085a23d8ebce502082ae9461bfd60fd38ea10f829
AgentTesla
131347c9601fe7bc4e4cf621abbc69686360d1210bf0045d663d97adf5fbef6f
AgentTesla
1beeee8be1d1210689501aea9ee2ff97fba886b65ecb5fc92a9ef0f732021428
AgentTesla
263573ece93d13d69ed99ea6be5715ca5b15e1877ed09a274ca9cf55f4d16a22
AgentTesla
7c20b6f451289a81014f1a9213b7401b92a5b2c024554929bd570da4c4bdbe3f
AgentTesla
8af6ccdf9c60f235ed2d82cb83bde963542797f038d130fc5662d9b0254e1939
AgentTesla
a62a90789d488d851050ad121400c40bdcbad55ff7acedca829edff301b0342d
AgentTesla
ae74623e356130501507540ec165aa3ca088a7cb27bae50769998b6cb6538f0b
AgentTesla
f81ffe76cfa1447a52ab6613c83933a5040b49221bb16c5a86ba416b3026240b
AgentTesla
+ 10'620 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/200624-zqkh9w6tvs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12776/

Comments