MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75c50efa907178d38b65adee406a6758288f7f69299dd2c26bee91e738a175f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	75c50efa907178d38b65adee406a6758288f7f69299dd2c26bee91e738a175f3
SHA3-384 hash:	c266ca871145935045cdbd0d10aa23f8d599fe0ca1f695634e5ac4ac5ee8cf4179444b461e9c8ce5051b21e4a66885e1
SHA1 hash:	6e569bf9293cbd57eb91722a825c78bfd1557758
MD5 hash:	5a79eaf73d47b66fdda8023f0cbf29db
humanhash:	autumn-red-beryllium-vermont
File name:	Invoices.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	519'168 bytes
First seen:	2020-07-27 22:24:40 UTC
Last seen:	2020-07-28 01:28:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'602 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:57zzb2JS8JdhBMHnAXAa0oVTP2xPjSq8BCK:laRtWHny0iTOdwB/
Threatray	10'608 similar samples on MalwareBazaar
TLSH	18B4E00426F4876FE1B9B7F073B740401BBA705A64B1EE5D7CD6E0DE10B6B608A60E67
Reporter	jarumlus
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/33107/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.373.22366.1135.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/398976

Signature

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/75c50efa907178d38b65adee406a6758288f7f69299dd2c26bee91e738a175f3/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-26 16:55:10 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=oxcq56uqof4nhc3fvxxea2thlaui673jfgo5fqtl52i6oofboxzq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5579e53b061e5c449ca231a05e84e0c90cceada35d9e4677e083ee77ffe8718b

AgentTesla

638603145c3aac570237325613344a3fd83bf2fc737ee5acd8230e0ee1afb0f5

AgentTesla

6e85d010198944cd284d9fdc636e1d690d6c77b2e1bfabbc41e1f8941ea72332

AgentTesla

771e1fa33b07cab386e1c9ca1a6a264a68bfbcd1b17fa4252a836ac4cd165e0d

AgentTesla

a37509a6354a72dd281648e71465962fb4d12ec51cb0ea796d92684a36996f75

AgentTesla

a96f314ef38951221b646a5798f3086f7a7320c7cc669fe33238db949a058b3f

AgentTesla

c65cd2032c06e0dbfb61b04e33aca937bafe18760001ec39aaa83be81e8e4697

AgentTesla

e3736b761f2b82e91cbb074ea1345a6e1e103bb9cb4e043ff17eeb1705c70c94

AgentTesla

eb09747d42fcf03baf1c3d844ac469062b354defcdd6300a8c051c96b3d144c3

AgentTesla

+ 10'598 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

spyware keylogger trojan stealer family:agenttesla

Link:

https://tria.ge/reports/200727-2g9jbpczmn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/75c50efa907178d38b65adee406a6758288f7f69299dd2c26bee91e738a175f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar