MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
SHA3-384 hash: 6a3e0fc407286e1c09f6b42727c07d95332282b550932cc935558425a326ddc603f86a8fa2bfbe52019870bff9fcf732
SHA1 hash: c311515f6ab3690864b6405b474b19043f2e2b37
MD5 hash: d0be9dbee4fff683e1929ef234517d5e
humanhash: solar-sierra-eighteen-india
File name:d0be9dbee4fff683e1929ef234517d5e
Download: download sample
Signature AgentTesla
Create hunting rule
File size:908'288 bytes
First seen:2020-11-17 14:58:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:NipSBTAlEmxXLBMeNfPjxcdJi3sFj9sdQd/RbPlxOECl+rMtwr+9jjRv4CS9Wjyi:cme9PjxLOpsulekMtVHv4GyE
TLSH A315DFE6A3982F67F07DD3B599284825C3F1ED52C7A3DB4D7C9E31CE8840E118BA151A
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 07:00:22 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=edjodqcksdlrbk5jkurrhcoy6nv5u3ah4ecraersasvwyw2uggwa._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-4hx5ehmz6e/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
MD5 hash:
d0be9dbee4fff683e1929ef234517d5e
SHA1 hash:
c311515f6ab3690864b6405b474b19043f2e2b37
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
SH256 hash:
cc53153fd6b341a1ae3c6c98359036a910d7524407071bce280350105d4abae2
MD5 hash:
e0de7c091c8c60b03d89f068d4d3bbb7
SHA1 hash:
2740bf441986c54b2e877d2fcd7333be4b07e2a0
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
Parent samples :
9029fc110d6ad30af1c140d2c7af2192b17c04986ba7bacebed72d58c84241a7
33a99ba14b9e93cef87a604f7cf417ecec809ab10574a6aef214ca39454144ef
af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
2724536d5c8f56b46361fe1801cec990b885938dc7f1ef031a399065678ceb71
20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
SH256 hash:
a5120cb77cef188a869b7f47711f3137747ee2e9fed715c409670c375d9c24a5
MD5 hash:
02a1f4fc9cc26f30023428db37fb751c
SHA1 hash:
31a40452e29a0ea3ab80418f9a8e21cd182efe06
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
SH256 hash:
615c754df6f8ce9e4b293e17b1277a8cfa4e799872f893cbc4ecb3940f63f982
MD5 hash:
afa4f1c2263b4a65ca84b3e7708b979a
SHA1 hash:
4f985d60f9a70a79f03644417a97ce22a07292d1
Link:
https://www.unpac.me/results/1f6c95ce-f26d-4b47-9d0e-cfcd2bfa5b7b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekshen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments