MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dca04a092036da431753ed714b8e11bbd6ed1db8c9b3755d05bb8c61fcfc805. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dca04a092036da431753ed714b8e11bbd6ed1db8c9b3755d05bb8c61fcfc805
SHA3-384 hash: 9d34fcf1d3c0bb00e2e12b01a83409c7c232dae7eca8a0f2c4de4493acc446a22799dcd4d033e749f1db56c625b21bf0
SHA1 hash: 8e88e8c6bd2d8352e1fbd19d963fe360ba261f7a
MD5 hash: 983dfa6f4b8cce2f31659b46c79e9cc5
humanhash: comet-xray-paris-uranus
File name:Assign Document.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'028 bytes
First seen:2020-04-27 23:08:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7eae418c7423834ffc3d79b4300bd6fb (54 x GuLoader, 17 x RemcosRAT, 16 x AgentTesla)
ssdeep 12288:GzoD4ekSIjQfDIlY9ox2r37dTfouDsvDiR2HhFwn:6oD4ekSW+MIoGpIvDW2HTwn
Threatray 10'777 similar samples on MalwareBazaar
TLSH 38941265B284C4A7D55353B03C3D99172667BE3F28E0970B63997A0E6C772C312ABB13
Reporter c_APT_ure
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Myxah-7546094-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EKCH.14211.11984.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-01-13 13:27:00 UTC
File Type:
PE (Exe)
Extracted files:
77
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f75f6670487368f4ba9f5cf419f8f96433a2c4176bd2d07c4a12d0c83963abb
AgentTesla
39cd1a914f603bf76cfcf07aa65a0395901b42124c9da3ce3ef61b5b71982dc1
AgentTesla
7a89bde0a6c3c23a3eb3b6e44f0ea164a30f8fe80f07cd5e016006dae718acc2
AgentTesla
7ab3cbcd225fda209a34c512ef956131c4430d84b7836b925739701686a24630
AgentTesla
812885bd3e3817364ce6ffa74109a191a3a158c2d9e9504eab4575cb3930935a
AgentTesla
ae959627b8dce98a55d585f5a930fe4b7209059b0ccc59ed81b916268ca85478
AgentTesla
dafdcd9e9b75c4d7187fcfb384788bf5925a1a3426eb7e6d3cc2147b5e9bdc66
AgentTesla
e6f2d277d61fd27d2a6452619111c272047ff478247251c9ec5651f5f67e1519
AgentTesla
f23a280b7303eaf61fc3f6650dd4f879d80250d2db7051ed569f5270dbc4c22e
AgentTesla
f427ee2e2b27288bfd45b0aa985b3fc19e4b81fac28b8e6112529632040b2ab9
AgentTesla
+ 10'767 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments