MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d
SHA3-384 hash:	2eff761a6231c1720bbcf9224275ee6f2c6732cbe51fb9cba59a3d00b54ca9e9c71ad6090dc93e918c6d18e0aa31e4f3
SHA1 hash:	c414d83a88d601abbe7d8bbe8eafde905be329ca
MD5 hash:	5e2e7fcc11bab293eba6ec68363cd6cd
humanhash:	delaware-hydrogen-six-charlie
File name:	5e2e7fcc11bab293eba6ec68363cd6cd.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	32'944 bytes
First seen:	2021-04-20 19:09:14 UTC
Last seen:	2021-04-20 19:59:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	384:HeAgpXmTqLw39tSdv4VjH7QKWcO8WKWRlNI9C2LPUR4KyCiyMcm0NU8hEFu:+AkmTl9tSdw2KBGLYxz/KyHJb07hE
Threatray	4'094 similar samples on MalwareBazaar
TLSH	F9E2F96A51A17519E59308342D55E9743F2C673268C0E10FE862815CDF93BFE78EC8EE
Reporter	abuse_ch
Tags:	AgentTesla exe signed

Code Signing Certificate

Organisation:	dINbOYdKqpBgLYRZlxpzVNkC
Issuer:	dINbOYdKqpBgLYRZlxpzVNkC
Algorithm:	sha256WithRSAEncryption
Valid from:	2021-04-20T12:58:04Z
Valid to:	2022-04-20T12:58:04Z
Serial number:	bf327dbe65c282d51d65b2a16d1b1e0d
Thumbprint Algorithm:	SHA256
Thumbprint:	62fe34aefb6f9b166502c612ce95f517f54bbaa82b64265dc1fe1f87c644d8ea
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/140159/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.8554.28860.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a file

Running batch commands

Creating a process with a hidden window

Sending a UDP request

Launching a process

Unauthorized injection to a recently created process

Adding an access-denied ACE

Creating a window

Using the Windows Management Instrumentation requests

Sending an HTTP GET request to an infection source

Changing the hosts file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-04-20 13:12:39 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kywzuqzg4cpmw74yqnk5dvlmhhicl4usypj6rjpddgr76lceqzwq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

20930a912e8c5fc24f604f9605a234e5c2b887d1c1351c1c03cebc199a88e089

AgentTesla

27645f1d148b659a43b23aff406fd0a354c0f4c5ad89eadc475cc5b58244c83b

AgentTesla

282b5d50f956c8ac1dea9080f1ba21129ce937a6d234fad62e17136509ac5166

AgentTesla

3b3f6d41ee6c1f630f6aa74edbe5d524fe2333a91e5234509c647432f663819f

AgentTesla

535fc42d2f30f39926f25da2b11211c6076ce166c1389df0419db06a3432b852

AgentTesla

a12f642139a7cfe0891e40b83400cae049a06c959f742700d47f096ccaa32736

AgentTesla

b08161f518814ca5bb0fe0e4e7b0031b422342f4bfac77d817d4b727437c719d

AgentTesla

bac6798be56de75cadacacc1030c5e09f0dc1dc6970de721fcb21bf44b59be24

AgentTesla

d0b4a4ca3f6d68b06b3547de97b61876f2bdb4a3fd23ebfc65d4a267da63b830

AgentTesla

+ 4'084 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210420-7jrdx689n2/

Behaviour

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Drops file in Drivers directory

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/562d9a4326e09ecb7f988355d1d56c39d025f292c3d3e8a5e319a3ff2c44866d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time