MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
SHA3-384 hash: 24d91d80644d79cacca7812dbec86770f455bcb531c6879baeb5a69c657bf8c8eaa274204c4b8118a9069eeb9168e822
SHA1 hash: 8b63a96cb99998e5104c1c8948aa52fe46791616
MD5 hash: d407f2f28bd78bfd137026e324e4e24a
humanhash: green-lamp-johnny-bravo
File name:16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
Download: download sample
Signature AgentTesla
Create hunting rule
File size:792'064 bytes
First seen:2020-11-11 11:37:33 UTC
Last seen:2020-11-15 23:15:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:rpm2hfNxdacdtMHxnsxjxp1qaKi5AnC9IO:9msN/acAxnKjxp1qni5
Threatray 9'770 similar samples on MalwareBazaar
TLSH 55F4F12127A86F69E07EB3B96135141447F5F4A3F332E64E3DB910CD81A2EC497B5B22
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/531965
Signature
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 315083 Sample: 5orMiteLE3 Startdate: 12/11/2020 Architecture: WINDOWS Score: 100 31 Found malware configuration 2->31 33 Multi AV Scanner detection for dropped file 2->33 35 Sigma detected: Scheduled temp file as task from temp location 2->35 37 7 other signatures 2->37 7 5orMiteLE3.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\...\ObxreNPsDrYmV.exe, PE32 7->19 dropped 21 C:\...\ObxreNPsDrYmV.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmpCA07.tmp, XML 7->23 dropped 25 C:\Users\user\AppData\...\5orMiteLE3.exe.log, ASCII 7->25 dropped 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->41 43 Injects a PE file into a foreign processes 7->43 11 5orMiteLE3.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 smtp.yandex.ru 77.88.21.158, 49720, 587 YANDEXRU Russian Federation 11->27 29 smtp.yandex.com 11->29 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 Tries to harvest and steal browser information (history, passwords, etc) 11->51 17 conhost.exe 15->17         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 11:17:21 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cycyvdxwnxarws2ecfitid32pdhwcesymai6kg3dywm4jms6ws4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a6447ca302af67b351842f078f0462cf33c95d587da76e220322cd9bd9803a3
AgentTesla
0e0d278117ddf353b9e09166522f14d139e8ae31f01463918e69b0190895f8c6
AgentTesla
436314d8b9afa67d0e70b72b19c6d3d3309983980b65ca857d46b78fdfc40d56
AgentTesla
5acd3c33b0f99f0da2b80e0287d9fdda80e732c7eb0fdee796e30c76a5d64e71
AgentTesla
5c84f2554caefb0e9c0dde339b82f6b6da0d049788cf8d06c260f8bce6df652e
AgentTesla
9a4a5ec81b23f16da34b34d5c368c71c085143be5e37b0567e0ddfc62d1f98a5
AgentTesla
a156f059e33c74475da8e54db1c506852e693dec5ebbbb8b42207776f61a29bc
AgentTesla
a4b3f2e56eed3604a93d6f4705bc9631347f5166b661f37bc9ebb074ea5a50d5
AgentTesla
c2aeb018b7852237a95b24416c3935595d079f7584884244b9a1efd92c19ac0c
AgentTesla
d0aba2a5256b4275aa90d032bf30e8d4168a70893f7b1badec622d80b2a57e33
AgentTesla
+ 9'760 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201111-psaerd8bhx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
MD5 hash:
d407f2f28bd78bfd137026e324e4e24a
SHA1 hash:
8b63a96cb99998e5104c1c8948aa52fe46791616
Link:
https://www.unpac.me/results/2e1dcd1a-212f-416f-89eb-2d706f55246a/
SH256 hash:
cc53153fd6b341a1ae3c6c98359036a910d7524407071bce280350105d4abae2
MD5 hash:
e0de7c091c8c60b03d89f068d4d3bbb7
SHA1 hash:
2740bf441986c54b2e877d2fcd7333be4b07e2a0
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/2e1dcd1a-212f-416f-89eb-2d706f55246a/
Parent samples :
9029fc110d6ad30af1c140d2c7af2192b17c04986ba7bacebed72d58c84241a7
33a99ba14b9e93cef87a604f7cf417ecec809ab10574a6aef214ca39454144ef
af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
2724536d5c8f56b46361fe1801cec990b885938dc7f1ef031a399065678ceb71
20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
SH256 hash:
9836870e9025417ab4622bc4d6c020968838e2943ff418cbb04d78e67f1bc24c
MD5 hash:
969d92e67e2078085c8a6feccc40962b
SHA1 hash:
7093b0472a8edc97537fbcf059278ca136cda6a3
Link:
https://www.unpac.me/results/2e1dcd1a-212f-416f-89eb-2d706f55246a/
SH256 hash:
44b6f5b83070bc2a902a17c0e13ac994d4bd232e7d053e50b4d250e25915fc44
MD5 hash:
0a769fcd74498c9f08b52b21a9345b80
SHA1 hash:
ba82fab6e2e0ea103055883a804dc66ef6fdaaa4
Link:
https://www.unpac.me/results/2e1dcd1a-212f-416f-89eb-2d706f55246a/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/2e1dcd1a-212f-416f-89eb-2d706f55246a/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments