MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1
SHA3-384 hash: 69fc092f4dd0686c844a3ba79b95516401356cdb887d587c16c34620267cb50cf3f7887ce0f3e1dfb827df87aab4a750
SHA1 hash: 770ae182beee02127f9d3c8e69593832639c1814
MD5 hash: 0aa8894091e5865fec2c30bc35d7b446
humanhash: victor-item-wisconsin-berlin
File name:Request Quotation for RO Plant Materials.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'240 bytes
First seen:2020-07-02 05:56:00 UTC
Last seen:2020-07-02 13:56:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:pntLvDjx0kMSZIuvTZL3NNuYVEve9K+Z9D:lhvxi0rvlDeYVEvl6
Threatray 10'677 similar samples on MalwareBazaar
TLSH 78A4F024ABEC5228FC7E1B70E9B14608537378A46836D66E094CB15E1FB7F848791773
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17784/
Detection(s):
SecuriteInfo.com.Fareit-FVR0AA8894091E5.1787.UNOFFICIAL
Create hunting rule

Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/381662
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 05:16:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=disy6vijvyn3j3nm42np2qklulymwstqr5z5nuyqtkqcoel42wqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c2bc64a7bfeaa6b61a5094ee4562008df806659b49e81f449e74be07bfcd80c
AgentTesla
46abd3805e5ec1a866ec2d4dd13be62b40d76ca6c0002347ed33699039e4c977
AgentTesla
6cdb58c8b2b2e5dff8994a157a8b467b8ed2619bbb5622df3a12f0ba78d7cd37
AgentTesla
7a4fbdd95415de552357735945b668843e9166d49a847a98b4cba946be2afd27
AgentTesla
844011c676208303cf9a895ad7d5ba4ec4a4fb9f905311a1b3baec0884b34f1c
AgentTesla
b4b66175ff6c5b420ce662fc6f88cf7ee232293535b556fa4e9c4868d755c52f
AgentTesla
bda58e31e45ea822d7b59a1cc4421de12393f9f955a0ba51837040e9ed8547ca
AgentTesla
d3391e9c475243663aa77b0c4f57e482cf6738498a3e15c7ada35079da92edf5
AgentTesla
d4e3bae2154ae1c4e7609f284310bb16ce70fdc9875e15928ed1b0f6f44438e2
AgentTesla
dbdf8847c3248a7b5df69d597b6da2163be990721ab221f5e114ac04d1b29eac
AgentTesla
+ 10'667 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla persistence
Link:
https://tria.ge/reports/200702-97jefmrfzj/
Behaviour
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Modifies service
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4c81a327cf41e3d1ee12f8b1c044381c1fc1d667f7815b81e1572e035698e039

AgentTesla

Executable exe 1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1

(this sample)

  
Dropped by
MD5 4ff0c119cd7f2b40553f531ce207f168
  
Dropped by
SHA256 4c81a327cf41e3d1ee12f8b1c044381c1fc1d667f7815b81e1572e035698e039
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17784/

Comments