MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5
SHA3-384 hash: 35bf0983db4ae1b7e7857a34b0f9f06a4eb666f095256040a7d7a91d0b2d213b1434d100d9678d61221f1c2725af031a
SHA1 hash: a48be22e7d9c1cf542df2d093f51f722b98b21d1
MD5 hash: 447c4c12f776d6c9eec26b08eb1ec84e
humanhash: stream-low-nevada-nuts
File name:Draft Invoice copies.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:886'272 bytes
First seen:2020-11-17 14:49:14 UTC
Last seen:2020-11-20 01:04:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:3Mtzv3CkVYRfCZWKmxXo9NK33qOJlwlKGWIBu08M40sx4qeMNW3NPLKc3XQldIB:3UzPChf4233qOJiyNC40ZqCK9PI
Threatray 9'815 similar samples on MalwareBazaar
TLSH C9151254737AB2EEC837C53286211D38AA60EEA50637D717682BF21DAD3D583CF211D6
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 13:16:50 UTC
File Type:
PE (.Net Exe)
Extracted files:
39
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=inwazab46hwvnie44s5garzocuec7tgf3bhfq6xlxoyvtveh722q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
04803c612483d76474860d5942b69d5ee3a68987a258b76283d60b345c188c62
AgentTesla
0d4d3af44ed0aa3154be8537fa238439090826f9f5cc264b967e60699f0e9d4a
AgentTesla
24f9b41f0801760c1baaa6d3958bfd6e48c7dcda2720a80a5e71638da70d7ff2
AgentTesla
3d009dd1124fdf76e4a5284fa421d54a0ec663abc1517bbf95c809bb36dd8863
AgentTesla
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
449668f18d2aa75cc9493090764722eb4f0843a8da1b354d4e2147c6d6393078
AgentTesla
52356a622db66e07663fd4cb2ed303bfb0f0272d2f21a3da414904e2c611600f
AgentTesla
7c6a987b9a63992f13adc130b38aee07d79d8786178c9cf339915112a28a7a6f
AgentTesla
a52c72aa195562b2f469e6dbc1e2e7534aec440d4674cedb788f3800286ecbbf
AgentTesla
c1f797506aa00305f7d7df4ef9933904a58c03c7da3f5a20f9087279ea71a1d6
AgentTesla
+ 9'805 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-dgk8wqlzea/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5
MD5 hash:
447c4c12f776d6c9eec26b08eb1ec84e
SHA1 hash:
a48be22e7d9c1cf542df2d093f51f722b98b21d1
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
SH256 hash:
83a0ea8b81e89393fc3c7008a14085beda3646a357a7259b7f002f1429621ef7
MD5 hash:
6d3a66465ad0350693b61f5a458682a7
SHA1 hash:
1cf37ccd73d09405dacc9a33972a3a475e198c30
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
SH256 hash:
a4e01c1b03904c020e48cc36443ebf31d7e04f53a57d9c5ac0daccd75caff2f7
MD5 hash:
1352ff3efafc0ac9e9ab2cd08eebed2b
SHA1 hash:
acaf8d47167976790e3df88bd63ed30b0d32d49e
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
Parent samples :
7c6a987b9a63992f13adc130b38aee07d79d8786178c9cf339915112a28a7a6f
436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5
e9839355693536c3d416824964cdabce19938fe1bae7109567cf6d95af6f5ff3
6932cd91548a70814291bd9793e7e048526cc4f183e5aa3c9ca8ba9b243a8474
64cf6c6d753b20e2a4d9ffc5f39706602e80a90c8ed8efce79d7e6535805302f
e7aa669d895afe3d45e3b096f3f1b5d0d36c0f441175b677fe4541733f5cb61c
34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526
f317e0dc1f74b0e49135d97d78c57a088121a9e70644e0eb3092489b9b753240
SH256 hash:
06356bca8c7604c50251644b7a5f10c769663d24fc02d4b629d74921ac70ea72
MD5 hash:
36cbad92d0ede809fa65a259006a5b6e
SHA1 hash:
b9b7df0c3d2d70f9ac5b97cd4526eb4836278cf3
Link:
https://www.unpac.me/results/d2cd9d66-e373-4aaf-a252-b986919a0674/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments