MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2990c7377c1e35344334f59f989421aa62373adca2589ac317a0818ff7213735. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2990c7377c1e35344334f59f989421aa62373adca2589ac317a0818ff7213735
SHA3-384 hash: 3eb461255153b71d046463410fc4e4327bb7c87af4cc4d44b9dc6872727a58461187782d853922a5c113b5ad5f4b6d04
SHA1 hash: ac011d5c7d329d598393ecb650052e40a1e4ec86
MD5 hash: 1902530c9b30db6e0b87e99eef3846ab
humanhash: colorado-nevada-bacon-july
File name:SCAN 0949 17-03283-LTS9 Doc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'168 bytes
First seen:2020-07-28 13:21:53 UTC
Last seen:2020-07-28 14:07:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:MqP+mPWUe+BwKeAnDGvjEIdpfm/FvPz+7/kZzeUybYSN8ae0Y5:tmhD+3e+DGIIdtm/Fvy7/KyX8dh
Threatray 10'658 similar samples on MalwareBazaar
TLSH 74A4122032D167E3CA3CA7F4182091581372F3A65722E71D2EDE25EE2DA3726C761767
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.ringedmarinebd.com:587

AgentTesla SMTP exfil email address:
biillmurray07@gmail.com

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/33677/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.24343.8289.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/400379
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2990c7377c1e35344334f59f989421aa62373adca2589ac317a0818ff7213735/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-27 20:05:19 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgimon34dy2tiqzu6wpzrfbbvjrdoow4ujmjvqyxucay75zbg42q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
23eb05b6df962a953c50eabb579e6a0a9358ca3f1a6319b9a98bbdb0be4ed611
AgentTesla
2c848c6a7b578622be6107d158406229bc3e5871cb4e7ec7b8b9e673a178c018
AgentTesla
332287b244dfebbabac15b5b4dd3fc3bb6f488d3460c2de5259254136040d0e4
AgentTesla
692e5432ac04059e4ca7f231a635908160f62126a38a046bd874d21c6ee2edc5
AgentTesla
924a88861bc8088ea5d9bd39765638b6376bcbe32930413ebb0dfb688554e0de
AgentTesla
aa556dde1f62e5e897bf5db6980f8202febe626f2e9840190f1f2695eec3c065
AgentTesla
ad7db1393e62d89dcb0039aa5ba64a897e88d3f6b76d146ccf419e952e57c317
AgentTesla
b7f19729b194bac7f587a7cc19778e925a218fec8106b23466367b2847b99ea2
AgentTesla
c8e97577eeb35634eecb4cc3b4917d2f851691bf318ed79b298eb3830c641a01
AgentTesla
f14fc92da65b07a614451782f1749ee492292ec5e422bf51239ae675a8df8c99
AgentTesla
+ 10'648 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200728-zn3jsj3egx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/2990c7377c1e35344334f59f989421aa62373adca2589ac317a0818ff7213735

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/33677/

Comments