MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75d96bd9b1835e445b9ea6151181cbbdfe64bf6686cf24d4b595591b951f5c62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75d96bd9b1835e445b9ea6151181cbbdfe64bf6686cf24d4b595591b951f5c62
SHA3-384 hash: 01a0084a2af742cbd30cd2ebe6b42c01e1b032c4ff565f7ddc703819f3213e5c68768aadefb5c9569d57d3c668701a1e
SHA1 hash: d18676e9a399ad518205d91ab3d883b326bcb1a9
MD5 hash: 024df2280dd513698e286305569ea4dc
humanhash: early-mockingbird-wyoming-summer
File name:024df2280dd513698e286305569ea4dc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:308'224 bytes
First seen:2020-06-03 08:41:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'656 x AgentTesla, 19'465 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 6144:V6/MorZVQP3+cj4BylzgbIX/WjQwlXa5sThGFzD20br:V60tP3+JylZvxg2IGF
Threatray 10'585 similar samples on MalwareBazaar
TLSH 95642A7DAB88B902F23D1D7251D2522012F1D4834E12D34F6EC86FE9FF557C92A4A3A6
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
server257.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 07:03:53 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxmwxwnrqnpeiw46uykrdaolxx7gjp3gq3hsjvfvsvmrxfi7lrra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
00bb775a83dc7120a7ccb4d446b4bd555232631b15feb2d6472b52972b90c97c
AgentTesla
1a258f5509ae1bb4edace69afd414ba2f0cb4a708f73d6d3109aa027117cd5a1
AgentTesla
25d747802b9ce8ff29860bc3fd6c9822b18108b8b0b1f0b781924203f4ff48f3
AgentTesla
37f58916e43943d8dc35a2a931a7a6bfdb0a82ae3dd2f2579adefd6187a2c745
AgentTesla
47d82ba4710a3924c4c552d64568cc4e7384776ba1bbf1d84e2e9104a4e094a8
AgentTesla
4e25b6d4521cf58ad62d8c11c621c6f54d4ebb0ee8f50cebd904c882e6c9a66e
AgentTesla
d7f11cc278c20baf70df2e5c59d06532b9164e894fcab195d6e5bc69ccf3af70
AgentTesla
e00520e9dbd220029d136401e441b14cc1f0b77272305a4ed045253b83c72eb4
AgentTesla
ef815a60779a455c972b48db32df542ea756480065844ae3984da559e9faba5a
AgentTesla
ef99cb1072520b6ca4f08d4684f795a17e92dbca8ef03d3875da1ca2b33021c0
AgentTesla
+ 10'575 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-12qb76f9me/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 75d96bd9b1835e445b9ea6151181cbbdfe64bf6686cf24d4b595591b951f5c62

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/375645/
  
Delivery method
Distributed via web download

Comments