MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 319e69233a48d2dfc8f683b13df518bb837d0669a29af60ce19db914e562fa6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 319e69233a48d2dfc8f683b13df518bb837d0669a29af60ce19db914e562fa6a
SHA3-384 hash: e4a003b640f1a34703299e9cd0d67535b03e127198b0d3a12620004d20d718432e2013188a42f67a0d06f6b58e657104
SHA1 hash: 82e10e77db9fefee2bd7799eb5e68967e5c337c6
MD5 hash: d82031957a2be27b7ec6599082d095ea
humanhash: nevada-island-georgia-single
File name:D82031957A2BE27B7EC6599082D095EA
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'434'112 bytes
First seen:2020-10-15 00:55:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:uAHnh+eWsN3skA4RV1Hom2KXMmHatjeaS6pFrAremqja0hbclTqpSZ4Fz5:Zh+ZkldoPK8YatSaTparg2WLB
Threatray 555 similar samples on MalwareBazaar
TLSH DF65CE0273D1C036FFAB92739B6AF20556BC79254133852F13982DB9BD701B2267E663
Reporter Anonymous
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71138/
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AutoIT-3.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Sending a UDP request
Launching a process
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/491851
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
AutoIt script contains suspicious strings
Binary is likely a compiled AutoIt script file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/319e69233a48d2dfc8f683b13df518bb837d0669a29af60ce19db914e562fa6a/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 23:59:41 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggpgsiz2jdjn7shwqoyt35iyxobx2btjuknpmdhbtw4rjzlc7jva._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
34cedb568c833efef91d94869b50b0d0b41f51e9dd882f9c2602f14f391b15aa
AgentTesla
37dd9ac0253be5eb6036877963ff457db90932e34d9bbd2c18852bf8bfd873c2
AgentTesla
48b1f899e7ad8d880a6bf9d97ada6507c4403c8d8e81815f83fb8181ca247008
AgentTesla
48d22944fdf7cf66fd1423b6ab2dd0143d96b4db7915e088088b8f826d46b000
AgentTesla
53c5fafa76a55c0c05e5f92c691d15a2f77708905bfcab8f68120150fe8c734b
AgentTesla
8a4e005808be8cb30ec3e12b0e4ccc62cc579a2860268c40ec1f28fb3b278da0
AgentTesla
a6b186142343526bf5e81790a1971d6f9b903d930ef335f9bdae62d0ba02e1be
AgentTesla
b3db12ee110a51adbbbe9901d5c5ad135aae575a37a8f2a5632b88eedacede6a
AgentTesla
e897888dd36ab2a5740030d628f510ef0563d9d039e896b45134a4a5c4a82bb7
AgentTesla
f3052467eedb90e28e1aad78395fc21e5f2bc53e90d5b8a1c7865464e86d9b19
AgentTesla
+ 545 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/201015-8xsp8j96l2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
319e69233a48d2dfc8f683b13df518bb837d0669a29af60ce19db914e562fa6a
MD5 hash:
d82031957a2be27b7ec6599082d095ea
SHA1 hash:
82e10e77db9fefee2bd7799eb5e68967e5c337c6
Link:
https://www.unpac.me/results/e72a1311-1daf-4ac9-83c2-7409f72716d1/
SH256 hash:
bed60336cb4baa2844b81d8f8a847a25c435cf0dd9dc1c9208c1649c1b1016a8
MD5 hash:
6d103f5bf5519f3725209d1fbe62559d
SHA1 hash:
2ef3f75f7bc4005417fdfbc82a167b6f5d673edd
Link:
https://www.unpac.me/results/e72a1311-1daf-4ac9-83c2-7409f72716d1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/319e69233a48d2dfc8f683b13df518bb837d0669a29af60ce19db914e562fa6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/71138/

Comments