MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
SHA3-384 hash: d76b1bfbe7ddf587a16a55779c03028adc96c4b0686f2b3c97f61ee3e99b9119601711574a48e9f36b6eaf9e08d06c6a
SHA1 hash: f7cf6ac8b8e2636bb813ae10e657600f9715e8c1
MD5 hash: a6e291abfc9187787101f632e8f61111
humanhash: nine-apart-violet-bluebird
File name:70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'768'832 bytes
First seen:2020-06-10 11:39:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 98304:y2cPK8kA66k0PmkoAtoMlK7iRp/extN51p:dCKrA6b0do0pR2Nj
Threatray 1'154 similar samples on MalwareBazaar
TLSH 1E06F1C263BD8062EF9D53766E07FA0742BDB91E012E7B1E1F45EE6A6838170326D153
Reporter JAMESWT_WT
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Packer.PhoenixProtecto-1
Create hunting rule

PUA.Win.Packer.PhonebookConfig-1
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.LightStone
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 07:42:02 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1aca49752cef2bb58d097e0ac96963e32f14e4e6b1e6e24e11125d1e9ef54cf2
AgentTesla
28006c46a4b5be075add55f0c3d152f0d222f6af26b69e8d1295bc1be363c4df
AgentTesla
6ec6d3425cc3bdc664f5938119469a2947ad061dac33fafbd303998c9311a254
AgentTesla
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
AgentTesla
72146e890efa1de6ee90e445ceb11ad9dc3b053fa5e82757756a393ee4617a77
AgentTesla
723080f3083b8428248cead3d4c3ad20883395e1d574f853bca15065d2217fad
AgentTesla
af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a
AgentTesla
cb8cf6b203f27f3b42020653f940d2be826893d079035eac52d4d64e1102aa29
AgentTesla
f0b43b05479d8dde3603ef587da02925b703d7d5bc8332656ab9ca7f7e1554a4
AgentTesla
f2e2cb71a06ac2a95a02168fc3d91f160e6e07ca19c5e6d3d708a9a486dd3f92
AgentTesla
+ 1'144 additional samples on MalwareBazaar
Result
Malware family:
dcrat
Create hunting rule
Score:
  10/10
Tags:
family:dcrat infostealer rat upx
Link:
https://tria.ge/reports/201109-drzbrnmdes/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies registry class
Program crash
Drops file in Windows directory
Drops startup file
Loads dropped DLL
Executes dropped EXE
UPX packed file
ServiceHost packer
DcRat
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments