MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e942ccf265a32c7a84eda0e71da06702284c318ddbd4ebcfc2fe1e3381ac5d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e942ccf265a32c7a84eda0e71da06702284c318ddbd4ebcfc2fe1e3381ac5d7
SHA3-384 hash: f3c38232afb126edc59faa89fedc7651c9de02423635afc2a933b4e858642b0b4afa8fe69d6e06e35ddd9b1beadb5b57
SHA1 hash: a2f73783d13eb9ba168e50b9f45933cf616d960b
MD5 hash: 54ef185e5cb7944ad0b22ad33b2b5b8c
humanhash: spaghetti-violet-violet-triple
File name:SecuriteInfo.com.Trojan.GenericKD.33970528.21649.1844
Download: download sample
Signature AgentTesla
Create hunting rule
File size:491'520 bytes
First seen:2020-06-09 12:48:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:v3oKjSk/i0zHRDH+b3me1mC5aBN9h6dUkgx4lSy237:vYKbHzB+DmtRBN9h6dHgxu
Threatray 10'588 similar samples on MalwareBazaar
TLSH 2CA4E10935647F9FC83E4BF948A41C1413F021BB526AF74ADC9364E99A9CFC68B14AD3
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33970528.21649.1844.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 16:15:48 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2kcztzglizmpkco3ihhdwqgoarijqyy3w6u5ph4f7q6goa2yxlq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1122cb2dfa13da1338dcb354406c8cacdb6362705486987af89f63e814afca7a
AgentTesla
1a9ababb0d36f8e517a5054495b624979525b05a425438e295f09578a21bcd7a
AgentTesla
2865a12b350dd2ea38de20b7b2a97f968c929114e408fa901b1e5a100b7c5ef4
AgentTesla
39c515aecf42295136801c4a1a847d80bc8269ad5cf20c512af98a020cd7a699
AgentTesla
3a632ffacb961b5f6d075395013be5162b65cddec7cf9f2229f12ce84fc7a213
AgentTesla
53c8eb7502e0c192c406e2f4494993fd4036402f339a25ff9fa23942d356f938
AgentTesla
573bf62a057b251920724ed4b890c79beef4fc52b9355038eddbcdd58957986b
AgentTesla
724ad2125f656d76082e67cb6c30ea8976fb01cc2819bb228f83526a33bbc78c
AgentTesla
c0c9d39c38d2a11f2fecbdef73f915ffc29f2d4c1b40817fa8dcf51233d66c12
AgentTesla
c885dc67b25339b6b1567e5b6e541eca318a61736d9c66569ad8241b9f10d87b
AgentTesla
+ 10'578 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-wprgj8phzs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 2e942ccf265a32c7a84eda0e71da06702284c318ddbd4ebcfc2fe1e3381ac5d7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/384542/
  
Delivery method
Distributed via web download

Comments