MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d
SHA3-384 hash: fdeb737e3f6e7c8027e3fcaa57796af9ff63b102623623fc37645bb37975f59d4ab948842165a25fbef7b6a8fd03ac0a
SHA1 hash: a851759d44439fb99f73b31ac63d4f610c8b5ebb
MD5 hash: 61112d94cef0ba979abbb5a670279b80
humanhash: illinois-diet-triple-golf
File name:61112d94cef0ba979abbb5a670279b80.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'920 bytes
First seen:2021-03-31 18:26:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:CCJxxBny1ArqoJV0AfqGC/kfP6I5uDvjFfo7F1ixlrLC7lf+x:CCH0at3u9e6rLC7lf+
Threatray 40 similar samples on MalwareBazaar
TLSH 7DC4BEE595889701D92B57F60D12DB2033EFBE2ECA67C4097EDBF2CD4956A834923603
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
61112d94cef0ba979abbb5a670279b80.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-31 18:39:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/715fa0d2-aa0d-4419-ab95-98c349c27e54

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/129782/
Detection(s):
Win.Malware.Malwarex-9845286-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 18:27:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbw3a2ind7qx2qnchwgqnllxxrrkaf3uwf4s5jsuzh64xy55xuoq._file
Verdict:
unknown
Similar samples:
01f2bcea9012a7f62815f8a61475d7e215e778387eae67a4c0aeda8a9a05e811
AgentTesla
1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec
AgentTesla
674b27aff16d272d81d002580257502c06f5f8d468141be2eef4386d51c91a99
AgentTesla
72a76728e56304e0d34e9f9512e20e8cc330376ac0d099862920cb003d161acc
AgentTesla
79f18eeef7d281b11f7e030d770b3c3fa0e7c595c61e4642e99c4eecd72c6c4e
AgentTesla
9afbb7350fafda2e3e4e86047c929d7dc7023956ab54f073de2ba2e93d176329
AgentTesla
b320affd7845fa88848b8143b7d3884162c3c7d653547b92e61826c90720dfcd
AgentTesla
b821cdf6b8cdb33d9f033ef0c5d444aedb5767ddf8c1faa87c79d7e7193e6d32
AgentTesla
d44ab027fea1af8575d4e42667e1021bf1cfbf2e7a56b7cd7e26a605d5720b16
AgentTesla
e972405e876cec1144ec48c09a4e8ffe7f1b01d81e08df7189a4a63069e41494
AgentTesla
+ 30 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210331-stxr72lrt2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d436034270fb2d5380e4fcecc1ee6c821a1701aed96045fa13f597da16be08fb
MD5 hash:
00cbf73d8b9f03417a3a32957ec64ed4
SHA1 hash:
b862eff1cf240a5ad5325fd258892e534484a6e8
Link:
https://www.unpac.me/results/35dfde67-605b-43a7-ae59-ac6a82a41ecf/
SH256 hash:
586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d
MD5 hash:
61112d94cef0ba979abbb5a670279b80
SHA1 hash:
a851759d44439fb99f73b31ac63d4f610c8b5ebb
Link:
https://www.unpac.me/results/35dfde67-605b-43a7-ae59-ac6a82a41ecf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1099897/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/129782/

Comments