MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e
SHA3-384 hash: faa14e3ad610ffc83d61ccd4f00ba2bff67809fbe3485e6a6ffc326ff9d7e1d2f562bf4db9854e2cd1e5d7fef605ffd6
SHA1 hash: d63e335a751b64229079bad5b81db36380a3cc5f
MD5 hash: 696564ad3fbb256c9934f32ce60fe3b2
humanhash: river-emma-oscar-illinois
File name:696564ad3fbb256c9934f32ce60fe3b2
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'248 bytes
First seen:2020-11-17 11:57:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:P/+lLTlyZce1aeDPnynTxCYht2bjANKHEFikGv8IethRgWdcRdBHMlU8LF:ukZcUa1VtoIKHnvpeth6Wdct8LF
Threatray 1'334 similar samples on MalwareBazaar
TLSH 2394F13122D3AE96E76A2FB5E16236841F753D27AA20D61E3DDC01CD1275F58CB21E32
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Taskun-9791093-0
Create hunting rule

Win.Packed.Generickdz-9792504-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 02:35:41 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rckazw226q66dsprsk6ms26sld2wglsaybg3g3wp6bzfc2bbpfha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0d77a7855565f1f714311f0b3fddfa7a924e833f4723bdb0cb6a7d28e910844a
AgentTesla
7c2f0c42ed478e241d2fdb2580915342c5dbd50acc3fafa26908ae73a581eb3f
AgentTesla
b8b373ce2f5835b617f904b50e5e594232982967ea1a12b35bd085c83aa057bb
AgentTesla
c20cdceb9065b28f9e80f21bf214d1eac74d40960f0bc9e4226d55e0ef9dfe61
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
c78e634f44b015861a2ff2b1ab448ca78016378cfdb15e9e482aa9606b416f8c
AgentTesla
d2adec41dcdb2142c210a4025572e29e1c011d079fa04504b35ab55c03376a16
AgentTesla
d97c5d2cc1d1411b1a64d4f06f341581cbc9048f0f9976df23a214591e7afff2
AgentTesla
eecb7b15a90df049ba18e11ebe23ca8fa83900d11f6154807da5bb07314f255d
AgentTesla
fdac92b0fe7d038bfdfa12127cae944e95dff1ef54684923785701d9e92dfaf4
AgentTesla
+ 1'324 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201117-2rkphaggm2/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
88940cdb5af43de1c9f192bcc96bd258f5632e40c04db36ecff072516821794e
MD5 hash:
696564ad3fbb256c9934f32ce60fe3b2
SHA1 hash:
d63e335a751b64229079bad5b81db36380a3cc5f
Link:
https://www.unpac.me/results/7c419cd3-0e63-4eff-8007-882d1173a29f/
SH256 hash:
0ecbf7a0b4d527515796376756354fdbd3b0472d6a3fb8022508ef603b42c158
MD5 hash:
72d71022bf32af96062e1aba2fcd6d44
SHA1 hash:
18deed1fcb0c4c7796cd15908f005e340431d1c4
Link:
https://www.unpac.me/results/7c419cd3-0e63-4eff-8007-882d1173a29f/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/7c419cd3-0e63-4eff-8007-882d1173a29f/
SH256 hash:
c722dd6dc28f71cc80bef59c08d65b77f672366a9720adf256881abd3323c3a4
MD5 hash:
93b3074242c17834e3534dd94832a7c1
SHA1 hash:
da5008b01f9494880807db7e5f9b804e1770ceb9
Link:
https://www.unpac.me/results/7c419cd3-0e63-4eff-8007-882d1173a29f/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments