MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036
SHA3-384 hash: 1b1c89f66ff844fb000b5c0d3de6f299b76765365cd375087714b4dbc4cf15e9dff18b454cd51c8b729e73f4cbc1f0ff
SHA1 hash: 8ba899303635121f52847fd448ec9d3c7f4f164c
MD5 hash: d4ff006e5323d9698585d7d76c4cc63b
humanhash: carpet-fillet-bravo-quiet
File name:519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'578 bytes
First seen:2020-11-10 11:18:22 UTC
Last seen:2024-07-24 14:14:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d444820d9facb23288061674446775bb (6 x AgentTesla, 4 x Formbook)
ssdeep 12288:cPPc291E7IkP8p3Yk+Ml5ikmUikXcV2b:MPcE1WIZp3Y/MOkmUvZ
Threatray 1'079 similar samples on MalwareBazaar
TLSH 44841205BAA1E0B1E85000F5955E8FA365BA783BA9BC9583FBC4530C5EB1BC41D27FD2
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/529743
Signature
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:22:40 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kgnqabkfbrb6pnhh3e7mgqrqigodbgye6tpucqytfazfrqlrma3a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08f9ff6bbe01d3fab54974c872fbdf2f8fa1fd1f32649c776f0626030169272c
AgentTesla
137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
AgentTesla
44cfa0be06349620b796b631d727ef0997c05097ec3cc72e0f83aed765b6c630
AgentTesla
6f175e5ca3aed259ec1288d9dbd2510bff46dd383f95c07d9495570699934445
AgentTesla
a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49
AgentTesla
c2330695f7393018b464630da587c9d2ff1cf9d1304f32dfed1b32f0037b78b9
AgentTesla
cbc1b2bb407f02710060a11cdd74386337b92597af3d8de8c1d90c33672868ec
AgentTesla
e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0
AgentTesla
e4179e2d5b9c04e7a59bf9b063c006f5695b5ec90600833006d38129ad0a48a6
AgentTesla
ecd685994c047195bf8a03b9e4a4ea800b970285806a417a9160153da37f76cb
AgentTesla
+ 1'069 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201110-jnzdw9k6d6/
Unpacked files
SH256 hash:
519b0005450c43e7b4e7d93ec34230419c309b04f4df414313283258c1716036
MD5 hash:
d4ff006e5323d9698585d7d76c4cc63b
SHA1 hash:
8ba899303635121f52847fd448ec9d3c7f4f164c
Link:
https://www.unpac.me/results/9c1e5e6e-8ff3-4fbf-92c6-42c6964cb719/
SH256 hash:
9b0b6cfe220cbc5f74b35b1f8b9e7725ef459f37610fee32332817763ead1474
MD5 hash:
b87461acf9131a6c2382b39273ae2b1c
SHA1 hash:
56d72560655202295e0bd7d53685db8c058ffe62
Link:
https://www.unpac.me/results/9c1e5e6e-8ff3-4fbf-92c6-42c6964cb719/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments