MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58bb593d1ee92aaa48bec847b56d18b04e1d140f4ab13e7c4f4b25a597aed4d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58bb593d1ee92aaa48bec847b56d18b04e1d140f4ab13e7c4f4b25a597aed4d9
SHA3-384 hash: 074a38d440cbbaad59c8431f3e5fa5469b1e53ea5d069304a07e63933a6aae956ae13ca5ba84374479bc08ab04914620
SHA1 hash: 327f1ec2ffc9fbb3bdaa18e2dd01ec1ebd1850d5
MD5 hash: 989d3fb8673beb0f30c0c361d82312b2
humanhash: virginia-arkansas-washington-pizza
File name:989d3fb8673beb0f30c0c361d82312b2.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:627'200 bytes
First seen:2020-11-17 07:11:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:fjuZYXWTIBwiZpY+9hmk/ve9dNafkqoMC4up0gHKukzo2na:CqfnYehB3ekfkqNI0gwzo2n
Threatray 7 similar samples on MalwareBazaar
TLSH B5D4133D37AE09B5CBFA9735B0B215151B359880D40FDF061432D6E97FE3B826942AA3
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.461.10985.11581.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/539105
Signature
Machine Learning detection for sample
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 318647 Sample: 6ru74ibq1L.exe Startdate: 17/11/2020 Architecture: WINDOWS Score: 52 13 Yara detected AgentTesla 2->13 15 Machine Learning detection for sample 2->15 6 6ru74ibq1L.exe 2->6         started        process3 process4 8 WerFault.exe 6->8         started        file5 11 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 8->11 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58bb593d1ee92aaa48bec847b56d18b04e1d140f4ab13e7c4f4b25a597aed4d9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 07:12:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
23f22a90458a4cb458f45b4233ea1df108d73cdd5f7ee24b23bb88ddab74496d
AgentTesla
3712dc4b66de055750a1bec579febd5a7b8dd4432a77adcf20599db4b0b0edac
AgentTesla
3745a056d8f798d0b84a3b1cbaf5858f38f1f7cc3198d66a95e65c18302fba03
AgentTesla
4adbefef01b1f96852f2f9029f6ccff66e8a20dfeeab348c3fffa98145f5a7e0
AgentTesla
72c5f337c25c6673db536039bf248ab7dceeed651b26ebb34c7debd53ad48440
AgentTesla
e694eadb2f24bf7de44a2cc1d1fbc3d2e84d83d6cac2be444aef377bea95cc29
AgentTesla
e8fc1668976751ae8b6a453020ed96065aa48636120b852363c45dfd26ec34d8
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-an4wqvjg9a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
25e6e56293c59c8a84986a15e491ab9c860259ee972a1e062a09834e961bab67
MD5 hash:
8ee0f15c61756410efb238b7aeebdaf6
SHA1 hash:
6e0f13a147e21756f6808d1ada082951d63a8627
Link:
https://www.unpac.me/results/ebee53a4-d6d8-4cf3-a62c-1cdd40f65cb3/
SH256 hash:
173d8042afda1267aad0777d279e893c489fa2df0bb688cfdd3b575a545f1698
MD5 hash:
f2b96f2975ab50897dc8efba5d4ccae2
SHA1 hash:
7599b2c4ecc2d4837dfd928c356a39cce60e7da4
Link:
https://www.unpac.me/results/ebee53a4-d6d8-4cf3-a62c-1cdd40f65cb3/
SH256 hash:
58bb593d1ee92aaa48bec847b56d18b04e1d140f4ab13e7c4f4b25a597aed4d9
MD5 hash:
989d3fb8673beb0f30c0c361d82312b2
SHA1 hash:
327f1ec2ffc9fbb3bdaa18e2dd01ec1ebd1850d5
Link:
https://www.unpac.me/results/ebee53a4-d6d8-4cf3-a62c-1cdd40f65cb3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 58bb593d1ee92aaa48bec847b56d18b04e1d140f4ab13e7c4f4b25a597aed4d9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/807263/
  
Delivery method
Distributed via web download

Comments