MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50
SHA3-384 hash:	350db4873e9f4bb5c95f3f356eb66ac0ea74a30bd8093686746a6da0793e4f2599bd34df49ed61e1d1e1109409d34d39
SHA1 hash:	9a4f5d62350cffa4e80bc2686bfac6f61c4ce5d6
MD5 hash:	b16281b993b722004bd111e7630bfe41
humanhash:	violet-stream-echo-delaware
File name:	Specifications_pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	776'704 bytes
First seen:	2020-11-13 06:58:52 UTC
Last seen:	2024-07-24 11:49:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3a05b4cb4bda4f85324d757349a4b9f3 (2 x AgentTesla, 1 x Loki, 1 x HawkEye)
ssdeep	12288:Y3ysqSzX5uJXppdpaHNv23Fy2UqzTyKdHhJomxKMLJotQMht2yK:XsqK+XppKHk1JzT1dHhJo3MLGyY2yK
Threatray	2'781 similar samples on MalwareBazaar
TLSH	51F4AF23B1B15C37C17316388C1BDAB45E36BE603A286BB62BE41DCC5F39691791528F
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

113

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Launching a process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/533547

Signature

.NET source code contains very large array initializations

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2020-11-12 22:25:58 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dmyj7os622s4zko7cgveeyz6a6t4mtj3ir2ijgqo3zsf3xs4bjia._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

39738c9fd5866fa8f6eb0473bb8bf03766e4fff79875f184823269e4fedb50c4

AgentTesla

512a3ca963394c011a96212499373a7baa29456fa0d501f72f42f49dd224f4a9

AgentTesla

5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c

AgentTesla

6f175e5ca3aed259ec1288d9dbd2510bff46dd383f95c07d9495570699934445

AgentTesla

829b61183bd6535cd7f8ecaa211cc2ebbbef3fd8124acea0ccdd8b8572524ee2

AgentTesla

8c3b25751ab09b3f9a6b6f9ce8271c13b5963565c2099077cfc9d30d6ff6abe7

AgentTesla

90c77987ce1e35af2b6b2713e635e4a01327c49f2c318916a99fad6bb6f5cf8f

AgentTesla

b6064cc9790f02ae68fe4150b25be527352129e5d9c49f81ac320c603996ae70

AgentTesla

d413b0233660dde742435354a5809bae228f7356eb6168eed64e03367de3fc10

AgentTesla

+ 2'771 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan upx

Link:

https://tria.ge/reports/201113-agpyebw95e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

AgentTesla

Unpacked files

SH256 hash:

1b309fba5ed6a5cca9df11aa42633e07a7c64d3b4474849a0ede645dde5c0a50

MD5 hash:

b16281b993b722004bd111e7630bfe41

SHA1 hash:

9a4f5d62350cffa4e80bc2686bfac6f61c4ce5d6

Link:

https://www.unpac.me/results/2b9e1055-df25-4ade-a256-846f4ef56389/

SH256 hash:

91a139c2a55c496780918244d3d4b07e9eb07dc9f3fac7807be96238d9ab16f5

MD5 hash:

242ee7173efb411b054bc8dbc90ed28b

SHA1 hash:

231e7c380e51abe13e528f220b33eda43e5bd148

Link:

https://www.unpac.me/results/2b9e1055-df25-4ade-a256-846f4ef56389/

SH256 hash:

db7e9b5f4de92be685d490727f016a09833455bb54b92c6d7a4673bb8f110391

MD5 hash:

a40ee44e8db83f47c0fddcd18128fb43

SHA1 hash:

f460a291981efb2e6128cf209eb2f5740dc0c1cd

Link:

https://www.unpac.me/results/2b9e1055-df25-4ade-a256-846f4ef56389/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.