MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5a443d5b69315505260e98bbb16ebce941f2cf8450fd45ce5dd6f401110770bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 5a443d5b69315505260e98bbb16ebce941f2cf8450fd45ce5dd6f401110770bb |
|---|---|
| SHA3-384 hash: | d984e0b65929550fcd642015245ce64a8ac95f5c52744a69432ee89696edcb1038f37ab936041d19f8b45683077538b7 |
| SHA1 hash: | 0cf0ec85acaef17b213267730a84ef810282b358 |
| MD5 hash: | 563fb7653bd14bb6e902fecf655ed295 |
| humanhash: | kentucky-maine-thirteen-oklahoma |
| File name: | 563fb7653bd14bb6e902fecf655ed295.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 521'216 bytes |
| First seen: | 2020-09-25 09:52:01 UTC |
| Last seen: | 2020-09-25 10:47:19 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 12288:/vv2zv1gr1jL/QXHj5oJOyFYhDnLMaWqHfYYttH:e2r1jkT5oJOtDYlqHdttH |
| Threatray | 158 similar samples on MalwareBazaar |
| TLSH | 31B4F1247799D721E87D57340430628903F1FA66F701EA1D7DFD24ADAE32B538B623A2 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Status:
Malicious
First seen:
2020-09-21 13:25:44 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
20 of 29 (68.97%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 148 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
keylogger trojan stealer spyware family:agenttesla
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
5a443d5b69315505260e98bbb16ebce941f2cf8450fd45ce5dd6f401110770bb
MD5 hash:
563fb7653bd14bb6e902fecf655ed295
SHA1 hash:
0cf0ec85acaef17b213267730a84ef810282b358
SH256 hash:
d233a7ea900ea3e88bb7b3ba2ddba84ae8027a548f69498f1740d7a402705abb
MD5 hash:
1f6e3c75f03537f4bd79016d7678d644
SHA1 hash:
0e117204dcf51562782164bf3245d9e01e08662b
SH256 hash:
04aee74823779bf339419fe194d5f269ca831622cc3c2929e7ed10684f07164a
MD5 hash:
5f5604646b3cc099ed14c958f8ef292f
SHA1 hash:
4087469669ac113b5e2b24c7fdcfb8a8ba2dd3a1
SH256 hash:
76485409cb017a48f703d8a73e92a807317d284627a4b87a795f284da27fdb28
MD5 hash:
22b288aa906b7b3388fbd89ab79f2ece
SHA1 hash:
5335cbda006c009b2d7ece5532557c3008c1e2d6
SH256 hash:
d2e0c2b0f936063fbb94ab46662a87d425b6a2836c39146648c5df62eec9dbb9
MD5 hash:
7e166facc3c8876c0bcd29c01bd24b25
SHA1 hash:
5931f98f7c39601d4066e4aa6016cc2ceae6ab98
SH256 hash:
f91136b3f9578e4787485acb78c2e8426f29b2b53137f30b9da2ddef7f1aa0d2
MD5 hash:
5540aa958af14cc012e560ae882105e2
SHA1 hash:
934fed584590da075b3119b23fc3a67de85588a5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.