MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 70043ff6d416c9ac20ada0e4b9031e5d55d2733a96eb4ddf3ec327c4b8abd8d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 9
| SHA256 hash: | 70043ff6d416c9ac20ada0e4b9031e5d55d2733a96eb4ddf3ec327c4b8abd8d2 |
|---|---|
| SHA3-384 hash: | e801d257a2cc508d316174971152260f430732ea41d4f618faecf10dec49ac888ee9caf32a9f424dd8bc5614abe39e01 |
| SHA1 hash: | ff3310ca5a1b378f8c1a907f5bf6eeadda7cc710 |
| MD5 hash: | b9a6f2fd33abd628d33fe30575d28857 |
| humanhash: | bravo-december-carolina-april |
| File name: | Nuestro nuevo n |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 450'048 bytes |
| First seen: | 2020-10-05 11:44:53 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'664 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:qqVJcM3+GqMycU4dUfFsmGC6Ggk+UEUp5/AGbYzz3bDj8EyrNnFiE50p3TuM/UB8:qqV056pk+UPAG83oRATuM/UgkU |
| Threatray | 322 similar samples on MalwareBazaar |
| TLSH | 25A4D0A08A982B9FD36D157CC8C1617083F4AE12921EFA8C7EC870D557F1741BB653AB |
| Reporter |  abuse_ch |
| Tags: | AgentTesla ESP geo Nuestro nuevo n |
abuse_ch
Malspam distributing AgentTesla:HELO: auto-deal.gr
Sending IP: 45.137.22.56
From: Livia<xasapi@auto-deal.gr>
Subject: RE: AW: Nuestro nuevo número de orden 155717
Attachment: Nuestro nuevo nmero de orden 155717_pdf__________________________.gz (contains "Nuestro nuevo n")
AgentTesla SMTP exfil server:
smtp.alhajikudi.com:587
Intelligence
File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-05 07:21:32 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 312 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
70043ff6d416c9ac20ada0e4b9031e5d55d2733a96eb4ddf3ec327c4b8abd8d2
MD5 hash:
b9a6f2fd33abd628d33fe30575d28857
SHA1 hash:
ff3310ca5a1b378f8c1a907f5bf6eeadda7cc710
SH256 hash:
01dd844990e0c5fdcea0f88712253aa1ef4750316f0734ab7099306170b5ea2a
MD5 hash:
eb593633270aa19162cf64663df9dd6c
SHA1 hash:
2ec57181471ff10abe9a04239ca3ea86ea4252b9
SH256 hash:
412a8fdb6d19fd10f4c8edb1476c60cadbce49d695bba41103bd8e1501187bd5
MD5 hash:
6f2b6db9d2be76497fc9850d922f4d5d
SHA1 hash:
2f3cd3b270cb4cbaa1d23d2e5c4a631ac3504df9
SH256 hash:
be9397a8b7a499b32dd39025465925ae4f41ecf6a73d809ca67838f64c9d30cb
MD5 hash:
b55b628c9c98f015cdc96c3c3803bf81
SHA1 hash:
4e48a34298399707ed683313ee909eafc68375a8
SH256 hash:
801ebd71727616c45360abf1bf918ce0528f347bcc013568a45c262d4ead85ed
MD5 hash:
d890934ac88d5f07d661d3ca8fd5fbf7
SHA1 hash:
c5fce4b7177df4af33c389adf7f88d88a72e2f0e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_AgentTesla_20200929 |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.