MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a
SHA3-384 hash: 657c2f525033b05c1c146c3094f1324a5bd5eeb4661258497affa212f3e64e49ebb175dcbe1f2af356da99952f4aeab9
SHA1 hash: aaeacc757c271f4b12b73aaa6ebdc72d3d5fb2df
MD5 hash: bf9f9669c380979aa5db0099562dcafe
humanhash: carpet-nevada-autumn-floor
File name:554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a
Download: download sample
Signature AgentTesla
Create hunting rule
File size:339'968 bytes
First seen:2020-11-10 11:42:50 UTC
Last seen:2024-07-24 14:29:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8b86b20ae2ec625a9eded7dcf9f30fd5 (11 x AgentTesla)
ssdeep 6144:ccr4V2NQVcQWBjFFoChXaTZJ5MNcSLEaHs7ALA7VCd9JYnRliVxee56erpy5vhv:0cNucQW5oChXufuGSLRHeALkk9WnRl9b
Threatray 1'079 similar samples on MalwareBazaar
TLSH 5B74022275A1C071C816C93556BD9BF5DEBD78724AB26443FBA80A988FA07E14F3C353
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.329065.19546.18648.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/528431
Signature
.NET source code contains very large array initializations
Found malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 12:38:39 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvcxfksr5nvdvnhbxnqvceick5fldpzjmrla4x3ummjaynup6mfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08f9ff6bbe01d3fab54974c872fbdf2f8fa1fd1f32649c776f0626030169272c
AgentTesla
137786f20b01ea831020cafde76ca06e6bdb2304525692aa46a7b98207b6bd93
AgentTesla
320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e
AgentTesla
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
AgentTesla
6f175e5ca3aed259ec1288d9dbd2510bff46dd383f95c07d9495570699934445
AgentTesla
a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49
AgentTesla
acef7155f56a1434770c602a92ebf4945474ad85e9382df19ff5d3ffee461423
AgentTesla
b64834eeb000aadaea8048153c40436a4aa12e1ed93b506e5fb7146465b4943c
AgentTesla
e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0
AgentTesla
+ 1'069 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201110-ycv8ynp5m2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments