MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83b1d755208da6440d8d5879378f6db6449ed5e33c18302b47a477ec85082dbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83b1d755208da6440d8d5879378f6db6449ed5e33c18302b47a477ec85082dbd
SHA3-384 hash: d6e29232b364c4aea52b1e71318b3771709d8f9f4d8ffe9dab15c3793a4ffc39d6aca707d45425e12a6e0adab348efd8
SHA1 hash: f78c216a588a84be8de61e0b98b283a9f8f2a767
MD5 hash: 9752c42ff0e04f8eaf6f350b7b4e07e2
humanhash: zulu-seven-stairway-ink
File name:MV.CS FLOURISH.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:585'216 bytes
First seen:2020-06-01 11:48:18 UTC
Last seen:2020-06-01 13:18:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:jrqcze+i4Y0tIQGWegBD17KCjSL96rkDB8LtVWSfJX9:jfiJLWegJBlSxuk98jf/
Threatray 11'175 similar samples on MalwareBazaar
TLSH B9C439A0257AC18BE7D98DB11E9CA17075F5287CE8C4B14DB4E57A29A1E63B011CC3FE
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 05:53:56 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qoy5ovjarwteidmnlb4tpd3nwzcj5vpdhqmdak2hur36zbiifw6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0060732dcb2f0ca7f2e8866f569ae58536aa8615a612c0f0f9fa9818e49a2a4b
AgentTesla
271d081750e61123ceda8a898533f5b636254030a65f14a71ecae2b8ea649443
AgentTesla
2f6a6d53e0ea3b6314279e5990a77c0acd90791f677086bf0a1b40fa48917222
AgentTesla
3be937bd3615e1178d145560c18a2dc17c6301de53bbf16b64aeedf1d6bf0d9a
AgentTesla
400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320
AgentTesla
769b37ba66756e16758f02f74f9e32c7207da79361cdf04f7c3e92600a8b6e6d
AgentTesla
7e68b29fadf839d238225f50e5e5db677690a7cf968ab59484571bb6002a1311
AgentTesla
a325f636f8f04610f7abed81f75739bba89f86d802415efd6725e127619cbf02
AgentTesla
a3f8c63b9925504706f889dc1bc944a5485144007b80b042cf53accda4f650c1
AgentTesla
cff3d5fedc8fdab09a7b27524a02503b53f4f7378ab0a09219701d3b9c3e68f4
AgentTesla
+ 11'165 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-lbtymmgvz2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cf39dc0e4727bfd3a0bf5bdb7909f91027dac2a1c80267838ec1d9b650b567bb

AgentTesla

Executable exe 83b1d755208da6440d8d5879378f6db6449ed5e33c18302b47a477ec85082dbd

(this sample)

  
Dropped by
MD5 2c0455ca8df3b913f3a6154a2e6da1fa
  
Dropped by
SHA256 cf39dc0e4727bfd3a0bf5bdb7909f91027dac2a1c80267838ec1d9b650b567bb
  
Delivery method
Distributed via e-mail attachment

Comments