MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49
SHA3-384 hash: 918e03cbe4462f4d13cc439bed82d6368264fbf2b1dc4eadeec20dba7aca20b5c640576fc15cf89f064745f0dfb5eef7
SHA1 hash: f78dba48c61f15486998b76841751b0d7d464c64
MD5 hash: 84584cb8b2e46a0de11d4a084d68e910
humanhash: march-foxtrot-black-sweet
File name:original shipping documents.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:764'416 bytes
First seen:2022-02-03 09:49:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Nl+m2uJrf2SzBOLTh8DMMnGO8WfJmSRZtRCO5UF6XqAWKEj:L+LuJrusYaDMIZVrhRC/F66AWKE
Threatray 14'530 similar samples on MalwareBazaar
TLSH T127F47A39F78ACD48C43686F601BAF7500F617D9E59D29ACD2BC973C80A72ED61A4C41B
File icon (PE):PE icon
dhash icon 00ecd0f8f8f0c400 (26 x AgentTesla, 20 x SnakeKeylogger, 5 x Formbook)
Reporter pr0xylife
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/231855/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process from a recently created file
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61fba56018d1bfdde4ef27a1/reports/ac44af70-21e5-4917-95b3-3ff40c6e2f16/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3dfc7ae7-d653-41bf-a066-a005b993810e
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/933193
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 09:50:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
38
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dhzvsgt6bi3wsr3xy3r2niwurny4icocepjbnd6ppto3nn32rneq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19ea70b85d1e0c5c9c9ebb1f2412ee14b363da45f5ba68f7f8ea217fe6dcb975
AgentTesla
5da4b57909cb661822c8814842892c6ac54d9c259befd24241e16a8cb1d33ced
AgentTesla
8a5bc3c75311f008ef8790b86807f8ba141ffe0c159badc3db9df7b930ed0a1d
AgentTesla
b162861aa27412994b916445ad9163b8899adf02d8cf3b6cea3cf1515565fad6
AgentTesla
d92b018bd0a734c33e897060f4e71b671b6ec9a5e4e257cc3289e03c7f0e8f47
AgentTesla
ef6c3ea83ae0bd98f409e5637d4f55f50c454b39e09f7d90fdb9571e662cf527
AgentTesla
fafe3c7c1660f4baadeaedff9ae0ca32e57407b991f01e5a965e8e19f6c133b1
AgentTesla
+ 14'520 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220203-ltyb1afbaj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendDocument
Unpacked files
SH256 hash:
dc2eaf45ed82dcaa965e45d47d0a06f80d99f222d8b94ff1bfc68828bd446bc9
MD5 hash:
95c10b110638fcb368cf656cfcb43c2a
SHA1 hash:
d587f34186a986d9ab8a1fbb7b847c8f517732ef
Link:
https://www.unpac.me/results/e97c086b-0933-44e0-9133-91333b2600dd/
SH256 hash:
a0c71b912823f1837ddf8fb3094a1ed1b63f8db13d6d0666c8240eba516015ce
MD5 hash:
efc7cd525458fcc4c54c093b8b350523
SHA1 hash:
79d5117370691f073f8bec2af7fc1a52a22af944
Link:
https://www.unpac.me/results/e97c086b-0933-44e0-9133-91333b2600dd/
SH256 hash:
0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9
MD5 hash:
263b5190f7ac42d83c756dcdf38147bb
SHA1 hash:
78f419fe3936ed7d603706c47230cd3e6ff79ffe
Link:
https://www.unpac.me/results/e97c086b-0933-44e0-9133-91333b2600dd/
SH256 hash:
19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49
MD5 hash:
84584cb8b2e46a0de11d4a084d68e910
SHA1 hash:
f78dba48c61f15486998b76841751b0d7d464c64
Link:
https://www.unpac.me/results/e97c086b-0933-44e0-9133-91333b2600dd/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/19f3591a7e0a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/231855/

Comments