MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16dff524e764f19be7a7851841235ef4406b22866e500ca592b678c55fd70bf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16dff524e764f19be7a7851841235ef4406b22866e500ca592b678c55fd70bf5
SHA3-384 hash: ea712eccd7371b80a15214490dd5a68c36a7e4a870c0d7f3e566a7a9d5198c0b6590bd8b560f2775289820000a1b5fa9
SHA1 hash: 6c87e49695b800bb16ad89162f1b5c27a62f0caf
MD5 hash: 20c51d51c89f7484fd5433af1fd6a8af
humanhash: washington-beryllium-blue-violet
File name:LIST OF PRODUCTS NEEDED.pdf.rar.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:456'192 bytes
First seen:2020-11-19 06:43:58 UTC
Last seen:2020-11-20 00:18:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'614 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:t4bJCNoZPKdWIW6dDL2QGCDnE5dkfF4gLfES6v+ZxcoUpSTDuxMt8LF:t4bJCNoZPKdWIW6dDL2QGC7EvgL8WAaq
Threatray 1'385 similar samples on MalwareBazaar
TLSH BBA402725122EFA2EB6E1EF1D25126440FF5BDA79A10D60DBEDC01DA2066B18DE04F73
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/542286
Signature
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16dff524e764f19be7a7851841235ef4406b22866e500ca592b678c55fd70bf5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 00:00:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c3p7kjhhmtyzxz5hqumeci266ragwiugnziazjmswz4mkx6xbp2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
51d5859f266a7b373d71b9fd71d2eec4975a8d35fb01486f624b9235120e12d8
AgentTesla
72ad22e7df09e217184e472645352c8bfe28a44afe5fda4659f4082268d33da3
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
8d10af8f247bb74f1a3d0878785f3afa173c82d4c881f29dd5b60ea6ed5f6b90
AgentTesla
9d1d3e7e960ed2939190d8cb99aec48b885dabfc1b9f61bbfcb5c4a5abd7e6ab
AgentTesla
b8b373ce2f5835b617f904b50e5e594232982967ea1a12b35bd085c83aa057bb
AgentTesla
ba3548566c5eda9447bd910346549f92ecc5cd51f959f51cc7bc836a2ce49501
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
fdac92b0fe7d038bfdfa12127cae944e95dff1ef54684923785701d9e92dfaf4
AgentTesla
ff30ebf52489bc096912d3d89259f8f6e44ec3ced1d124094d10f2fbfaa18590
AgentTesla
+ 1'375 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201119-mxn3hljkq2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
ServiceHost packer
Unpacked files
SH256 hash:
16dff524e764f19be7a7851841235ef4406b22866e500ca592b678c55fd70bf5
MD5 hash:
20c51d51c89f7484fd5433af1fd6a8af
SHA1 hash:
6c87e49695b800bb16ad89162f1b5c27a62f0caf
Link:
https://www.unpac.me/results/511876c0-165a-457c-9b21-6871546dd83d/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/511876c0-165a-457c-9b21-6871546dd83d/
SH256 hash:
923ce0c057f53a38b0c4036d7e4398bdbb547fe0ed1e7bb19cbe7d9489a913ed
MD5 hash:
a0f37e0c0462a664a83f66d2425716d4
SHA1 hash:
c4eeda59f38bbdcfc3df1116b9c2f3d614268ae3
Link:
https://www.unpac.me/results/511876c0-165a-457c-9b21-6871546dd83d/
SH256 hash:
20a80c871aa1e7fdf47179eb2eee5ec2c24c1bb79f39d79c902fb511f050da14
MD5 hash:
efb478e3c5545ceb473f7d364e0c9ba2
SHA1 hash:
e029def17b013721ef2fce6867e00e283b62d369
Link:
https://www.unpac.me/results/511876c0-165a-457c-9b21-6871546dd83d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fb12c91bc0dc5763fb90901122ad44310b5198342173baa6f7072ea241aed63c

AgentTesla

Executable exe 16dff524e764f19be7a7851841235ef4406b22866e500ca592b678c55fd70bf5

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 fb12c91bc0dc5763fb90901122ad44310b5198342173baa6f7072ea241aed63c
  
Dropped by
SHA256 7c757d8230c968fb34d59eb20ffd70b33660f78b42b322a47bbf04f32f0969b9

Comments