MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6108451bc6172dff2d36a0e89492843db32052d8471be14c286f93913c815144. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6108451bc6172dff2d36a0e89492843db32052d8471be14c286f93913c815144
SHA3-384 hash: c5f80db48915448f1be03a4ab007830e1cf07e201d1b397d9033468ec11d34170187d5a99e2eb590c9671e585dcdd7a3
SHA1 hash: a36c9d3f5cad08f9c66e274209174ba321d5e0f8
MD5 hash: 2a30994cde81c2a654aeaedce110e0d9
humanhash: don-vermont-uranus-victor
File name:2a30994cde81c2a654aeaedce110e0d9.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:606'720 bytes
First seen:2022-02-08 18:47:48 UTC
Last seen:2022-02-08 20:52:11 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'655 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:9qM+M7POvYEOmYbLM2Kdzsny6G2cv+IitGG:9qEPOvks2KdQny6GB25GG
Threatray 15'304 similar samples on MalwareBazaar
TLSH T1F9D48C2F49BF113AC6BDCB7198C0CE2FB426D5963937691D2A8625D905232F275C223F
File icon (PE):PE icon
dhash icon b3b3333969693b3b (69 x Formbook, 63 x AgentTesla, 26 x Loki)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/238480/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.1567.32017.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6202bb284077c8b9a02296bb/reports/ca555613-fe59-4b20-b770-7ab7ff7208e2/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a3fa4b7-f55b-4721-a981-1dde3e219fd3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/936547
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6108451bc6172dff2d36a0e89492843db32052d8471be14c286f93913c815144/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-08 17:55:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
19
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
054d100afdadfa10c55b97562d697358e8189b4d9414403626a480a7d4474c96
AgentTesla
143aac6980db6a14d2b66df0940a2b620942c4729db2f3ae7ec108225691acc1
AgentTesla
1e00993f9b487efe986bb97b3408fd6111d0983d29e86943c1deafc72ac7333f
AgentTesla
22a1bf1796ab58532e00602c90341a0e095f752c646c3614a115ede18c91f3cf
AgentTesla
363de4e060c67ac8f0ecbc4b5bef9768a561e6c95dc26872a0c6258e9f3f71dc
AgentTesla
421993c96075e5d85af8197bb352abac1828cf974df975c4cf8cf25cc34e1722
AgentTesla
5b7c7d4bf17521dddc7ee1accfee37d1b50e89f634e7c67439ae92dcef4c32e3
AgentTesla
6f06907399b2874873adf6c646317617d4ffd6ca8db7ef78430e1b92d3d971be
AgentTesla
c640be1855da7860bc3959d7d012b2d400af5c38e79d05a27639a867a37ac1f0
AgentTesla
e8b4d9d1b29d05b29c9a9fcf170748418899cc2438901a69b4f9f0a31e602ffc
AgentTesla
+ 15'294 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220208-xfrsvadbc4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Suspicious use of SetThreadContext
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
c63b10dd34f2c1ee403024a76b9552c30c3f6d4043beb98a2ecc35039431a2bd
MD5 hash:
ce2cd026a42ee824624b8b6bf5f9d6be
SHA1 hash:
dbc4c69c61a7120c3965f936f2d9eb75984dd799
Link:
https://www.unpac.me/results/fe9175b8-2a1c-4a2f-b765-75ad8391a69e/
SH256 hash:
0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9
MD5 hash:
263b5190f7ac42d83c756dcdf38147bb
SHA1 hash:
78f419fe3936ed7d603706c47230cd3e6ff79ffe
Link:
https://www.unpac.me/results/fe9175b8-2a1c-4a2f-b765-75ad8391a69e/
SH256 hash:
da614d4fbc3a75dbe183c561c463ccdd3660a59c961a25b001fcd13f47ca702e
MD5 hash:
7a8b45766f9e9b84fef841954923d889
SHA1 hash:
46a10f3ce02f0a9712be6eb26016fa393f880fc8
Link:
https://www.unpac.me/results/fe9175b8-2a1c-4a2f-b765-75ad8391a69e/
SH256 hash:
6108451bc6172dff2d36a0e89492843db32052d8471be14c286f93913c815144
MD5 hash:
2a30994cde81c2a654aeaedce110e0d9
SHA1 hash:
a36c9d3f5cad08f9c66e274209174ba321d5e0f8
Link:
https://www.unpac.me/results/fe9175b8-2a1c-4a2f-b765-75ad8391a69e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 6108451bc6172dff2d36a0e89492843db32052d8471be14c286f93913c815144

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2021905/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/238480/

Comments