MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10bc9fe5afc571c8c5e9099499f2fb9cbcde8b335ed36cf53783c7a405d0cfdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10bc9fe5afc571c8c5e9099499f2fb9cbcde8b335ed36cf53783c7a405d0cfdb
SHA3-384 hash: 6058e78fe7a4993ac092017966a7c5b4a6d7c4f9cd9312fa504d95d4e047b430f1222499a2307bf3f6e3c1c7cd722c8b
SHA1 hash: b3822e9b0981c2254191292834c7b9b9d0b346da
MD5 hash: db55f5d0c83b5d2ea487ab3cd9a2e194
humanhash: angel-rugby-solar-black
File name:db55f5d0c83b5d2ea487ab3cd9a2e194
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'049'088 bytes
First seen:2020-11-17 14:43:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:cfBusQViWARNOSFNTIS2Cp+jmuWUFWK3scS:cfBusQFARNOdS2oUFWK/
Threatray 1'331 similar samples on MalwareBazaar
TLSH DC25BDDD771477EFC82BC1718AA82C78FA50B8BB831B4217952341BE9A4C987CF145B2
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10bc9fe5afc571c8c5e9099499f2fb9cbcde8b335ed36cf53783c7a405d0cfdb/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 18:30:22 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cc6j7znpyvy4rrpjbgkjt4x3ts6n5cztl3jwz5jxqpd2iboqz7nq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
AgentTesla
14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
AgentTesla
519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036
AgentTesla
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
AgentTesla
5952cc403a58eab272b199a6f39c35bfadf8feeafbadc1a3d30a68e01e93b7ae
AgentTesla
5df302032fa38879552d9a916c18d5e019fcddbed9447b53f75f9e4b1b08e7ab
AgentTesla
97c73eb27f164d01020de5531c96adb305bfdd8e6ec727bfaf65a2fa7b02638a
AgentTesla
9c7002e97c59c4c190abb09e373a5f1010b4790dbcb714e792538e73820d5609
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
e657bccf1c7151a276add3092c70cf4691e6270eb9cb22e90ec5ece6a42f743c
AgentTesla
+ 1'321 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-8k588544z6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
10bc9fe5afc571c8c5e9099499f2fb9cbcde8b335ed36cf53783c7a405d0cfdb
MD5 hash:
db55f5d0c83b5d2ea487ab3cd9a2e194
SHA1 hash:
b3822e9b0981c2254191292834c7b9b9d0b346da
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
SH256 hash:
5f68144c49ca19e3fe7917b2990919f60715bcd11959596144488a486586c7b1
MD5 hash:
a5753a2f6947612f933e1c719f09101f
SHA1 hash:
347738460c5e2daa452c6673e1c2af40cd7c0d97
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
SH256 hash:
320440d4df2cb1ece40136d918cd5b75905b53e45a4e8ef504f79dd258232603
MD5 hash:
b0f4030764a968e44a24eeb61aba11c3
SHA1 hash:
b616c45d59707604d0c233c5bdb037a52475af2a
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
SH256 hash:
daffb23b11e3b840d04234fcb903e3019a2196eb5b40f26bc8a5ceeb46d3edb6
MD5 hash:
fbcbf6d7755aa1178c967226f4d422d4
SHA1 hash:
c552554ac32254f06029fe77af63a13ed046d551
Link:
https://www.unpac.me/results/b860d7fd-f0bf-455e-8fa8-f319be9c9006/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10bc9fe5afc571c8c5e9099499f2fb9cbcde8b335ed36cf53783c7a405d0cfdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments