MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3
SHA3-384 hash: 68eb867331b0acf5b7447c84f890fcea59a445296e778e9595f8f3f219f8b5225b2ed62226fd9f15433b36b98a91bd74
SHA1 hash: c2bb7e2d8901f6258937afd47db72f685a992031
MD5 hash: 0345cbd48c1f3953246a241b0b522d47
humanhash: don-one-salami-florida
File name:IRS_FORM.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'752 bytes
First seen:2022-02-08 16:44:20 UTC
Last seen:2022-02-08 18:56:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:T22JPYYsw2n4oSWV0D3xr4UPzB2YmljOdjYtpc0:TFJwYswjoRwBr4UPV
Threatray 15'076 similar samples on MalwareBazaar
TLSH T134B4CF8F721C739FC65BCA72B9740C709610AF63130BD606B4D3EEAC591D69E9E121E2
File icon (PE):PE icon
dhash icon e2ee8a8eb6d8ecf4 (56 x AgentTesla, 39 x RemcosRAT, 38 x GuLoader)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/238352/
Detection(s):
SecuriteInfo.com.Suspicious.Win32.Save.a.2007.24273.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62029e854077c8b9a0224df6/reports/c8aef381-7ea2-4503-a47a-d96c5cb045b9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cde3dba1-3380-4ebb-8a8b-d1dd4c8a6068
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/936289
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-08 16:45:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnpfbcg57ju66xpzl6esiz7umenlxxhoojf4dvd3xn3abtvsmprq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0156cc74dc52bcb6c9e1ea57e4e68825fb45a506e17701895e056a677d413184
AgentTesla
12b279cae78622ee760ccc4be44445388e916c93230b2991acf53ff6c8e68377
AgentTesla
1dba88d2a711e0efb588cb9465a78513b45c80736ca55b31a678993eb5d89152
AgentTesla
33990c7027bd2b71b3097729edcadbe6d06a4b8746dabe85e251793f64022b1e
AgentTesla
56b4f0d1d0a0ed41109abf11275097cfd12e8e79709f829914f6a89286606eab
AgentTesla
670b031cca042e01b07ece7021acc32ead795c2d64956c3f8754ff5f619dbcea
AgentTesla
d720d5e55684cbf894809d5963e95d6613af588bfaeb0ecfa6001beb533d0232
AgentTesla
eb62cecf43b2e2b3b9ed73bf2354f4387f8b9bb83dea24956be5602da1163869
AgentTesla
+ 15'066 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220208-t9ehtsahdq/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1810941027:AAGYriAwKBGodTLdcygtEUFTKeLsPNen6CQ/sendDocument
Unpacked files
SH256 hash:
2bb7368d21112dbc7ab1df18e522da31ed463002e7451cf7f41103d73bb32050
MD5 hash:
5ff7b0fff4445a8b07f0a2aeb8b80bb3
SHA1 hash:
ba6669146974aa189e1f6fcbba7b6d5024838050
Link:
https://www.unpac.me/results/4b611977-631d-4c07-840e-d71cd9db408c/
SH256 hash:
eeb9453c9f20a74dac13a45edcd37fd730af2e0603715f99f5119207a691a6bc
MD5 hash:
afb0ed7e721762d447d782e85b9ae0c5
SHA1 hash:
ae3bba3611c954a0f1b3cf6af0d80785c8ab3a08
Link:
https://www.unpac.me/results/4b611977-631d-4c07-840e-d71cd9db408c/
SH256 hash:
0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9
MD5 hash:
263b5190f7ac42d83c756dcdf38147bb
SHA1 hash:
78f419fe3936ed7d603706c47230cd3e6ff79ffe
Link:
https://www.unpac.me/results/4b611977-631d-4c07-840e-d71cd9db408c/
SH256 hash:
135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3
MD5 hash:
0345cbd48c1f3953246a241b0b522d47
SHA1 hash:
c2bb7e2d8901f6258937afd47db72f685a992031
Link:
https://www.unpac.me/results/4b611977-631d-4c07-840e-d71cd9db408c/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/135e5088ddfa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img fc2884b8be46a59bc270a9e73df1be45d7eb58b7cd27d5cae5bf9f432c9662ae

AgentTesla

Executable exe 135e5088ddfa69ef5df95f892467f4611abbdcee724bc1d47bbb7600ceb263e3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 fc2884b8be46a59bc270a9e73df1be45d7eb58b7cd27d5cae5bf9f432c9662ae
Cape
Cape
https://www.capesandbox.com/analysis/238352/

Comments