MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 480190443e701b4d129d789fe99b20bd84372470a14f2a113705735065bd43f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 480190443e701b4d129d789fe99b20bd84372470a14f2a113705735065bd43f6
SHA3-384 hash: 4c71f763a53921a5e14097827bf7e02a05ed40100638d2417a3f4f66c145e02e1689384533ed0f19f3d88c3766435c31
SHA1 hash: bb618e5d3c9299a2d98b1f69d639986f9d65738f
MD5 hash: 14c6a812aa8c4f96921387ea77f58db9
humanhash: maryland-may-delta-london
File name:14c6a812aa8c4f96921387ea77f58db9
Download: download sample
Signature AgentTesla
Create hunting rule
File size:26'016 bytes
First seen:2020-11-17 11:35:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:pYHsQ333d73QiSGOXmZ22isN9FedllbkCh0uUf2hS:p2fAr2cAgRbd7UfL
Threatray 1'282 similar samples on MalwareBazaar
TLSH 16C21A2C9BC4CC12F8BAE5351357C1706773EFCAA770CAC968ED90AA25927C19C291D7
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a window
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/480190443e701b4d129d789fe99b20bd84372470a14f2a113705735065bd43f6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 04:26:23 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jaazarb6oanu2eu5pcp6tgzaxwcdojdqufhsuejxavzvazn5ip3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b741b53e9abfd7d5147eff7fa963976a776e8bedb99d08ae6e7288525823a59
AgentTesla
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
38cf806ecaf30b5209ebce1a41e7ac877d3201cec05f4a665fe85797a7069bbc
AgentTesla
428b4819734a979d5685b235d190ab9e07bfd6e5098e22ee9195cd386dc701d0
AgentTesla
436fdd814820def5e208ef0ed29038a5f4b0e84b418694591c926b6961e1203f
AgentTesla
53b6f647f6c5d712e8ac0d200bb2e91d90814f649fd7eb8890367c0e8383b3ba
AgentTesla
8117efde6fd5ac0ab1698db8c25183c933cb93644526c0295a712deb598f57d8
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
9d8df34f842a101d2026ed540a5e28f3138dec4a223757860e842886d15033c5
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
+ 1'272 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-2x6dvq6njs/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
480190443e701b4d129d789fe99b20bd84372470a14f2a113705735065bd43f6
MD5 hash:
14c6a812aa8c4f96921387ea77f58db9
SHA1 hash:
bb618e5d3c9299a2d98b1f69d639986f9d65738f
Link:
https://www.unpac.me/results/2270afda-1708-4353-b833-7bc93bb774f0/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments