MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bc722aad7435c85cd523f14be5f6e910c5eccd13818fd4054fd156f40cbcc26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bc722aad7435c85cd523f14be5f6e910c5eccd13818fd4054fd156f40cbcc26
SHA3-384 hash: 935dab55b83d6719b0781214612b5a5e1735ec77015c51e1213feeacfca0f23c77adc6a8cc842dc9bb72328e430532ec
SHA1 hash: 6011a792dd7d4956ecd7181e9b3ec8f6e8005603
MD5 hash: e5583f274996606fee753ecd2524e416
humanhash: cold-oxygen-spring-potato
File name:e5583f274996606fee753ecd2524e416.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:284'672 bytes
First seen:2020-06-20 05:49:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:OIuDTfxKqnuyEasPmCczsD4yNPIL02y+peiLeEU0SFV/Bl+xhxhNhM7rWE92/:1w9/JJwmyXENS//b+xhjN6
Threatray 10'706 similar samples on MalwareBazaar
TLSH 345418692B88B902F63D1D3289E2166013F194874E12D70F6FC41FEDBF577CA694A386
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
server257.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9892/
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 20:20:35 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpdsfkwxinoiltksh4kl4x3osegf5tgrhamp2qcu7ukw6qglzqta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0687d57f87a19e9860bc0f991a91ea9af31f8625dd15d191f4fac7e73520b49b
AgentTesla
1631bd051bd9ef096e2cd29bba5c549e8b4028dc9de457c2bd5ee060c69a7e6a
AgentTesla
350a1cceb4f399c5d7515ede00aa6c9dbf6a6d9a4b96ad87f158005d58faf567
AgentTesla
35cfc1673d87e25347c6ebd9142e0ac184a51c68392c12c3ef7ec2f2ede87874
AgentTesla
54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7
AgentTesla
55e93e43efaeb600deafd813f7eef356e836904b0d83e545dc47b3ed0078316b
AgentTesla
7b668bf6740289b2750a497800467fcf725fb111071e3ea4e74153e5159a3aef
AgentTesla
aea1493bc9d4796294250d7b06a160c61f4014b1ca13473f4a5877a674083772
AgentTesla
e43e6c7ed4d0d2b6d30aedbb521203643e74511582425c6640cd2fd66f5ed6c8
AgentTesla
e57b3fac2ff014d32527f235abf0efc4ddf672cc3781b1d5964bd635ed21cdf6
AgentTesla
+ 10'696 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200624-9dxhmf86pn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads user/profile data of local email clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 2bc722aad7435c85cd523f14be5f6e910c5eccd13818fd4054fd156f40cbcc26

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/399469/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/9892/

Comments