MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
SHA3-384 hash: f0dfdd51338b6b7232c35ef8019a7ec86fa5dd11f0405fae910d474a1cd519856801e54efb069b8c5e663435e261b63a
SHA1 hash: d7043a67c649b960d175937fb1a090a29a1acfe4
MD5 hash: 0c6cae8962a0e2a5a1342fcf016c28eb
humanhash: golf-finch-april-apart
File name:14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'608 bytes
First seen:2020-11-15 22:59:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b6fd9945877b7e9d67b9e475c6d6ddf (16 x AgentTesla, 15 x AsyncRAT, 10 x Formbook)
ssdeep 12288:91JjrZT5s7w36EbwuLRkrqDjGc3BKndKtFu:91JU0bvGuBQdK2
Threatray 1'223 similar samples on MalwareBazaar
TLSH 34A4F114B8D2C833D0F61038499893A38975BD322B65D4BFF7D04F2E5E38AE29635A57
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/537732
Signature
.NET source code contains very large array initializations
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 23:00:50 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ct55okb35hne2d7jonvdvbvrw543jrfl3mdx6bshmjp5llmandwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0fc02fb4b07f919a0ff54d7e3ef0ca5fa9581fc26fa311e44338c32590f36a3b
AgentTesla
1e3772fb826af045d4d6aa5943be1c66bfca44858adaee941606ebce680373d1
AgentTesla
31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57
AgentTesla
4b54cee8f8b2575cee216504872b9849201aea876327300a57d34f089ecdcd57
AgentTesla
50737e711d6a55fe1c6e2289526e2d970a263ab033d93015b52a9fd2e3c5df58
AgentTesla
639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392
AgentTesla
841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb
AgentTesla
87fde2e49507d58cdcc464c5d3e36d322c7f77a4f9e5cc0f1a46455f1a67df5c
AgentTesla
e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0
AgentTesla
e788686b2a0e0efbf94e3f33a47e63494ca216e965191d82cd2922b8af6fe037
AgentTesla
+ 1'213 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201115-7tgsaqym76/
Unpacked files
SH256 hash:
14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
MD5 hash:
0c6cae8962a0e2a5a1342fcf016c28eb
SHA1 hash:
d7043a67c649b960d175937fb1a090a29a1acfe4
Link:
https://www.unpac.me/results/7c59bc20-5c86-490c-95d8-d43148d8cc6f/
SH256 hash:
2fca3ae5f7b6cd9eb31a8fc89a992900089ff7d14d9e4e38089c09fc0cae81d5
MD5 hash:
a354cbc5a2a14ae77cb05db45fef2821
SHA1 hash:
3bd5222d6a44568fdab6f667a29cf5d6a64d8e8a
Link:
https://www.unpac.me/results/7c59bc20-5c86-490c-95d8-d43148d8cc6f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments