MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18
SHA3-384 hash: c72e8d74f2763ed24df69a8a5258092b4b96dba0821d59a823392abf653c793713c10733c89267efb79031951a6c7b7b
SHA1 hash: a1d0f5687e25b883773163cf20bee8edfb9ce847
MD5 hash: 535bac93fb5c49345f960bc2585a7e66
humanhash: mexico-september-charlie-harry
File name:44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18
Download: download sample
Signature AgentTesla
Create hunting rule
File size:515'604 bytes
First seen:2020-11-14 18:00:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3916872f0c6ff6013ddd62c6b1315a40 (5 x AgentTesla)
ssdeep 12288:INcaRcmBZI291E7Z5cIRAfjlHJ7eHr/AHW:INHcEZIE1WvcMIFEL/A
Threatray 1 similar samples on MalwareBazaar
TLSH 4AB4F125BDE1D030C56312B68568A7A389BEFC725B7A09C7BBDC4E8C4E745F06325B12
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-9790835-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/536099
Signature
.NET source code contains very large array initializations
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:01:27 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ittbmii5somaxeklyqgxjoz2e44pkv2wbfqhx6yggwv37xzxruma._file
Verdict:
unknown
Similar samples:
b1f530942db69e2f7a2823abab2ecc03eaed957101e7e6a7b53af823765df3a7
AgentTesla
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201114-41ew7zwkyn/
Unpacked files
SH256 hash:
44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18
MD5 hash:
535bac93fb5c49345f960bc2585a7e66
SHA1 hash:
a1d0f5687e25b883773163cf20bee8edfb9ce847
Link:
https://www.unpac.me/results/047f9afd-35e6-4188-a360-58e16ddb747b/
SH256 hash:
fd4fd713a180327e432df84fe0b666c205eefb9fe75f4c859d59e1a6e052214e
MD5 hash:
cd82a0e3978902e5e3561531b7f12e4a
SHA1 hash:
d3f533aee9100d5f29028a01468c7ea0a94e6f25
Link:
https://www.unpac.me/results/047f9afd-35e6-4188-a360-58e16ddb747b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44e616211d93980b914bc40d74bb3a2738f5575609607bfb0635abbfdf378d18

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments