MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d
SHA3-384 hash: cfe389c7bd6aa3f98f572bdb5602d240ee7e87efe6e114b714ccfd2fa4ea1d40de046f4de5d1d60b323f2993115448ff
SHA1 hash: 9172cc29f00f4ca77f7d34c4e987440ceb72ea4b
MD5 hash: 0efc7aba09fe5ce6282a815cc8c5f5e7
humanhash: ceiling-table-yankee-undress
File name:TNT Original Invoice.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:611'840 bytes
First seen:2020-10-05 07:58:56 UTC
Last seen:2020-10-05 08:55:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:/UqtGsJ8XMFE0r0pcmEA8nK4PO1mCpCQp7Z+MCLmYt:/JGsJcMF/r0/E6wO1PCQp7Z+MFY
Threatray 288 similar samples on MalwareBazaar
TLSH 63D4E12072A85F26D5FB9BF65A74D154837A7E943223E38D8DD274CE2872B008B15B1F
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68063/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/481060
Signature
.NET source code contains very large array initializations
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 06:11:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnnyiybwnwhf3ipoakj27uaioezsqdypscckkvrlq4tncntx2ewq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1b9451e9b76e1ca8efb1139b25e035ebc9fd9a4c5aebd9d5651b27828d3b6241
AgentTesla
371f46d6159d5fcba2d1531a470938fcd195840aeaf1147ec894407a7387431d
AgentTesla
476ad07360e7dc543be24793d393a093a011090ba53b5aafb21069d177271e7d
AgentTesla
6e070df16a98956dd19b7313c542a8462704f95b8aeca246625d3a2cda152ba6
AgentTesla
6e176c82d8cf8842dc9f87b42be3713ffc55ab8a50fb4a3befed84f281706b83
AgentTesla
6eec8ab078921cfaf8ff874eebef1511e62bd5d4e81b50f68550685711285aee
AgentTesla
ba7b4dfc9852ed43efb9b79e6f9586f79b1cef29c7f9d793c3026e85bd1cacb6
AgentTesla
be2763ce4e6c5c6a228efc795006966af947a33bb7992121d9f139f161f7ab15
AgentTesla
bf56f62cbc583924d71c51afea9546cbfd6dafafe877553a3d1ca37a25d34767
AgentTesla
d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627
AgentTesla
+ 278 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201005-jphh6n8zxa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
3aeeadc3026aaa84d4b60aee6511773a38f19b12b29b8751b1396dcbc0725adc
MD5 hash:
e63bd1e338b2f4257d900aa1e2c083c6
SHA1 hash:
06f29c6dcfdb9c80c3b248e13c3ce0e7c501ddd2
Link:
https://www.unpac.me/results/e8a6c9a0-f8b5-41c1-adc7-597cb9d9a7db/
SH256 hash:
ccf5dadf67f9b04a32ceda8dd12692b1f4ef60d877513b79aa6fb909bc6c1358
MD5 hash:
2e7485bee41a02ada1d75ae8e4396432
SHA1 hash:
5d70cd6d84f84321fc49ef9f940bcb2ab1f55d21
Link:
https://www.unpac.me/results/e8a6c9a0-f8b5-41c1-adc7-597cb9d9a7db/
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/e8a6c9a0-f8b5-41c1-adc7-597cb9d9a7db/
SH256 hash:
135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d
MD5 hash:
0efc7aba09fe5ce6282a815cc8c5f5e7
SHA1 hash:
9172cc29f00f4ca77f7d34c4e987440ceb72ea4b
Link:
https://www.unpac.me/results/e8a6c9a0-f8b5-41c1-adc7-597cb9d9a7db/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 9428ff06813aafcc145f342aebde0176a910fcc9930d151d4c7d80e831892cad

AgentTesla

Executable exe 135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 9428ff06813aafcc145f342aebde0176a910fcc9930d151d4c7d80e831892cad
Cape
Cape
https://www.capesandbox.com/analysis/68063/

Comments