MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20
SHA3-384 hash: 0b58295d7f70ff8468b947a90a5ecc6368c1c222673e7b550e76ba330a7fe3c71f2454fbf6f7ac4fb0618cc59bad6302
SHA1 hash: 6a840e1bf0e36477febd38f992ca97b1392df150
MD5 hash: bbd9c7c4ea8812731ba169a92b4dcceb
humanhash: stairway-carbon-ten-papa
File name:bbd9c7c4ea8812731ba169a92b4dcceb
Download: download sample
Signature AgentTesla
Create hunting rule
File size:969'728 bytes
First seen:2021-06-22 08:36:45 UTC
Last seen:2021-06-22 11:42:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'654 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:P4GWFHm0uSMPQipP5099qFHa7zvDHqxbxddrrtEHFDtVV++Qv+M7kgS/HhPKt:6H/Rip69qFmDHqFRsVBSv+BgGHha
Threatray 6'039 similar samples on MalwareBazaar
TLSH E125AF120ECF421EE2758EB65770FC47C3B69DA62A05B2212EC032ADC9375DADDEE511
Reporter zbetcheckin
Tags:32 AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bbd9c7c4ea8812731ba169a92b4dcceb
Verdict:
Malicious activity
Analysis date:
2021-06-22 08:39:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/02bc3d52-3b02-44b2-bc52-aa26f05473f9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167499/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.1641.22712.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4950500e-7987-4efd-9d33-4c18353536e6
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/805833
Signature
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 08:37:12 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
045b92b336103f95c9a5acff35461d8eb69bbf9aaed8158787362e2853a50e4c
AgentTesla
2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb
AgentTesla
3e43fc7961678765fa09b867e27d15c9246bdd19f599a7b6e1ce215f3c03f104
AgentTesla
473ec4f2b7a198ff36e66b86cbc05848883b4dffeaacb8b9c97e67e88e977986
AgentTesla
55c05e011a2ed69bb4c04240820f50c433ffcda3d0792ea25c7cd272322112d8
AgentTesla
7e07c98e0f97b46db236ef8765108ce7bb484e29dab1da0924de402ff3b84bdd
AgentTesla
c1823f0befbdf02c1275d0641e142aeebc8d70d9dab04816ada7339da23061e2
AgentTesla
c1daf4dc27cec1d9ee1fb9644e12fb87d73d6b98b55e0edff9bf294e381e10db
AgentTesla
c3563e777c01c0ea26f7a8f26e598dacd68d096966011da76a5311f09ba21614
AgentTesla
d0a57c612c45b425b2b8ad871606465bf8d3ac3d0ec3bead26813f15ae46034b
AgentTesla
+ 6'029 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210622-tckejnrq9s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d7db4baf466c00ff4a739c434c3f0d924ccf4d4ff13f6b716dfc2d887ac6907a
MD5 hash:
2df99a8f102f3cbf9be86d2b65f2ab2f
SHA1 hash:
af848baad3b4116d5fda415cfa379f29e4b444e2
Link:
https://www.unpac.me/results/eaa1613d-7a94-4b93-b1ef-1212a0fd9545/
SH256 hash:
98191abc205594be740fe09ba681594790cba02f453a9adf748f508660efa85b
MD5 hash:
64a3766fb9bd1f16348454c370acacdb
SHA1 hash:
465fd7b955c15ab9c80b389c5aed594e8df864c0
Link:
https://www.unpac.me/results/eaa1613d-7a94-4b93-b1ef-1212a0fd9545/
SH256 hash:
9bb49d1231599a876cc45ddb5e5256ddbe6dadc021a01a3aca1e9046ae83bba9
MD5 hash:
487e8e11117460c5a4c0edcb2440caf6
SHA1 hash:
43d0e764f66acf76b7a9f9bf0549795d09ae03a0
Link:
https://www.unpac.me/results/eaa1613d-7a94-4b93-b1ef-1212a0fd9545/
SH256 hash:
1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20
MD5 hash:
bbd9c7c4ea8812731ba169a92b4dcceb
SHA1 hash:
6a840e1bf0e36477febd38f992ca97b1392df150
Link:
https://www.unpac.me/results/eaa1613d-7a94-4b93-b1ef-1212a0fd9545/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 1bffa62ec8cfff47103c41ff3de5a5f0c887c9958460d9f4ec00f5886d2a5d20

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1387680/
Cape
Cape
https://www.capesandbox.com/analysis/167499/

Comments