MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f |
|---|---|
| SHA3-384 hash: | 86994587b295fd17cffd5c76a914aa6b8519c1a015f69ec3bb95e271c2e0e08d7b88ea4d4089fb112ce139c54367f713 |
| SHA1 hash: | 471bfe5969ed9442b7dbb2342f73220e78678888 |
| MD5 hash: | 61ec1516ed103f7b62ec626f16dbf322 |
| humanhash: | happy-lake-video-gee |
| File name: | 84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 967'680 bytes |
| First seen: | 2020-11-06 11:31:33 UTC |
| Last seen: | 2020-11-07 17:30:24 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 12288:lJxVOMU6GSwbGSxdKySW6bExH9leqY2MbkS1pNV0vpvQc:lJzq6GSwbGcUdB2MbNzCvJt |
| Threatray | 10'902 similar samples on MalwareBazaar |
| TLSH | 6A256C416B248784D560B37701BDAB8927B1F5CB16C24B1A271F4725DFF32CAAB1F688 |
| Reporter |  seifreed |
| Tags: | AgentTesla |
Intelligence
File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Launching cmd.exe command interpreter
Creating a process from a recently created file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-29 03:19:57 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 10'892 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f
MD5 hash:
61ec1516ed103f7b62ec626f16dbf322
SHA1 hash:
471bfe5969ed9442b7dbb2342f73220e78678888
SH256 hash:
4511d23fd8256f424ccb13a8e6cecea692e629c5c2f00b47f9a5a1469dbe461d
MD5 hash:
4c610ab0b16daa66e26d90dab6517245
SHA1 hash:
1197a1c0623ecd73697e63b086ed0bc0206862e0
Detections:
win_agent_tesla_w1
Parent samples :
9efe056121715e1671bd1d940518b20f1b8673973ec009d2b84f24cadcea2c4a
3027bef9e4262ad05caadb38d130aeaed53ba3df25e3987b76f4d57a286f733b
32815b68e914e1be70f1151343016ba71e70e48358ff50a36a052ac4e8721990
84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f
ee357cfde91f8df2a686f81a4b8d72c9df2ad51645801ac8a7202b5bcff515f4
3027bef9e4262ad05caadb38d130aeaed53ba3df25e3987b76f4d57a286f733b
32815b68e914e1be70f1151343016ba71e70e48358ff50a36a052ac4e8721990
84b555de54d251346360a06f9537948fcbc653c81b2c733c02791bc64c6c4b9f
ee357cfde91f8df2a686f81a4b8d72c9df2ad51645801ac8a7202b5bcff515f4
SH256 hash:
4f690f3cf792f24a571f09740cf25d0979bde8c11180a26864056643c30479cd
MD5 hash:
304cc4a1948539064cfec5b70bd83e21
SHA1 hash:
32b3754f52323fd71b8349f01c9dd4bc4fecd880
SH256 hash:
542282ed737d2cb55e3cb59d05e58e8dbf6473d63461194a9ba597f0f3eb5d75
MD5 hash:
0ab09caf48c9dcbcbd53aef80493abd2
SHA1 hash:
fd985c8ed98d443fde035be26592b92662b9c5ea
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_extracted_bin |
|---|---|
| Author: | James_inthe_box |
| Description: | AgentTesla extracted |
| Rule name: | AgentTesla_mod_tough_bin |
|---|---|
| Author: | James_inthe_box |
| Reference: | https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/ |
| Rule name: | Agenttesla_type2 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Agenttesla in memory |
| Reference: | internal research |
| Rule name: | CAP_HookExKeylogger |
|---|---|
| Author: | Brian C. Bell -- @biebsmalwareguy |
| Reference: | https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar |
| Rule name: | win_agent_tesla_w1 |
|---|---|
| Author: | govcert_ch |
| Description: | Detect Agent Tesla based on common .NET code sequences |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.