MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea
SHA3-384 hash:	abe73a61a0eeb98e826155f6cf4d9288b321681eaddb3dda053cebba3945ce71e7697474f3417982052d815ccb301e5f
SHA1 hash:	8c0d4e116c48b67bae52f518d0b795c461c011ab
MD5 hash:	0b5b27ae4f3286e2002836882d0919d1
humanhash:	alaska-massachusetts-jupiter-fanta
File name:	QUOTE 213DUB.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'286'144 bytes
First seen:	2020-12-07 06:35:58 UTC
Last seen:	2020-12-07 08:43:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	24576:e6O6wEhAf1vtCMOOCMF0xRQdH4lB6FhqaTPST0sDdIo+bbK:e6O6wEqfJoMOOT6xRsH4lsPKT0AdN+
Threatray	2'007 similar samples on MalwareBazaar
TLSH	C0559D29EE904529FC762F3C98711964521F7FA3BB3BE84D28B531E91B77A8384C142D
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

169

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

QUOTE 213DUB.exe

Verdict:

Suspicious activity

Analysis date:

2020-12-07 07:18:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3475d622-60ff-48c9-8772-39e8d9e02840

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/106983/

Detection(s):

SecuriteInfo.com.Generic.mg.0b5b27ae4f3286e2.9416.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/556645

Signature

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-12-07 06:36:08 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

14 of 28 (50.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=flxf5olv2fx6webw3p4ctdclnxdinhpiwraglsxycanb6qftw3va._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

33bf5c7e008702144c8ec88d5e22c80609463864658612f818d43ca963a5d156

AgentTesla

4afc70d7e08f66f587fd37ce1848989853a7405435e92a3d25652781dec66348

AgentTesla

772d316873673ace45da234f8820d736d2f18c55eeab2b84a471dbfdaba963b6

AgentTesla

8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f

AgentTesla

a51bd84d3facb55aaa7d351f79a6383f50b362c48a7abf373675aedd13aa9770

AgentTesla

bb4fa1ef7cc21d3a4c66b243f542b24473441837a5aa5c453d9d89080b20acfe

AgentTesla

bb5655ed407d25d54cefaf7d9834192b007ea351bfd0237ea1d59f63333a9aef

AgentTesla

c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96

AgentTesla

e694eadb2f24bf7de44a2cc1d1fbc3d2e84d83d6cac2be444aef377bea95cc29

AgentTesla

+ 1'997 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201207-hbdlfkl54x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

9584f6d01e6452371cc9b4828030a13045d99c243c497b63628828e66aabe26f

MD5 hash:

7476e403eef14ac403c63c7279831780

SHA1 hash:

8387f558e30dc115987ac2b5c174a41302471abf

Link:

https://www.unpac.me/results/8761fdbe-283d-4ebb-ab23-2bc2d3dcf320/

SH256 hash:

2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea

MD5 hash:

0b5b27ae4f3286e2002836882d0919d1

SHA1 hash:

8c0d4e116c48b67bae52f518d0b795c461c011ab

Link:

https://www.unpac.me/results/8761fdbe-283d-4ebb-ab23-2bc2d3dcf320/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2aee5eb975d16feb1036dbf8298c4b6dc6869de8b44065caf8101a1f40b3b6ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.