MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c207a6ad28507e302b1165849b57a09695482d5c07bae27dcbba92a55163e5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c207a6ad28507e302b1165849b57a09695482d5c07bae27dcbba92a55163e5f
SHA3-384 hash: 14ce6b754baa15f510e7fd959e92e61f498dbf1eef5b7e73059bdfa942a647b42cdeaba676e429a4262fc1f352e91231
SHA1 hash: c2068fdeb14a2b74a4064d09a125ebdade741758
MD5 hash: 380979b9e21db307888adec96ee96f14
humanhash: zulu-king-hamper-single
File name:SecuriteInfo.com.PSW.MSIL.BTEP.15288.26195
Download: download sample
Signature AgentTesla
Create hunting rule
File size:233'472 bytes
First seen:2020-06-19 14:43:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:K+F8hWG4EPIJbYcI7t4XGo5UQYzjNaqyOF26Zy/ujXDfDhWLp709v38j3nq4pPi:choOThXDfDhOp7c0j3nq4pPi
Threatray 15 similar samples on MalwareBazaar
TLSH C3345C653C60F220E1AE973386CF992891C331A19FB6094D0BE32E8C57DD1BE5BD3965
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTesla
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9588/
Detection(s):
SecuriteInfo.com.PSW.MSIL.BTEP.15288.26195.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2017-10-03 19:09:51 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
37 of 47 (78.72%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0ae13a39ba870f8b572d742a201f342a022e9a541eea06143996839edd8a8906
AgentTesla
0e4c61028e569af183b697a0097f4668d1234478778b52a4b791da02b42096a5
AgentTesla
23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead
AgentTesla
268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e
AgentTesla
6269fd417f93e7c0d7cab576b35dc3b6f6a58c0f04e75533bad84987c228f0e6
AgentTesla
75fa551eec71d6d8b9817266813715c2bbb7a537005587f9f1e0d058a05febc6
AgentTesla
a6bf564665f281e7226d137f8da8692436c44edb6ab7881cab31282ffd6649ad
AgentTesla
e3afb8be8f04e148a4214c375eff4817f2afcfcaff0f6a0bf2f5e324d9649b1b
AgentTesla
e7d2deba4fccbea79ffa209ebe0ce49f98aecfb340c8d6ec3ea1773cb12cb07e
AgentTesla
e9a8bf4f31da146761af10a16f17c402c2de1bfbafe5f770b1ffadbe373a2aa4
AgentTesla
+ 5 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion persistence spyware
Link:
https://tria.ge/reports/201109-vvty9a65vx/
Behaviour
Modifies registry key
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Disables Task Manager via registry modification
Drops file in Drivers directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla
Create hunting rule
Author:Stormshield
Description:Detecting HTML strings used by Agent Tesla malware
Reference:https://thisissecurity.stormshield.com/2018/01/12/agent-tesla-campaign/
Rule name:win_agent_tesla_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9588/

Comments