MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89cc87e39f501d88416744a1d302092acda816628ba6812d5dc9e5cf2223dc3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89cc87e39f501d88416744a1d302092acda816628ba6812d5dc9e5cf2223dc3d
SHA3-384 hash: d27cf7e7bf5738f61e9b27ad06f3876fa06ff9841ed24ca049769144e117df681fe43b1f9deb89ab0cdd660be6700c33
SHA1 hash: 1d9029eb9c20c2c6d75a65e01176e0706051123d
MD5 hash: 62e47fbc1f180a5f2760f0f6e9b0200f
humanhash: lithium-delaware-mockingbird-hot
File name:62e47fbc1f180a5f2760f0f6e9b0200f.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:287'232 bytes
First seen:2020-06-10 10:04:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:3I6/kB+Oe3p9MQ7hs9sQAFU1pIN/Boj8KHCk2e:3I6/kFezJ7msdSg/pKx
Threatray 10'618 similar samples on MalwareBazaar
TLSH 6854196D6B88B902F63D193349D1166013F190874E12DB4F6FC46FECAB5B7CA384A396
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
server257.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 06:57:38 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhgipy47kaoyqqlhisq5gaqjflg2qftcroticlk5zhs46ird3q6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
084be7d5522c7679dc17d1aecc5e9bf4e23a1326b4632afd656a72f74a5e9e5a
AgentTesla
0cd0835a890fb2ec2f128c02e0e0c235e83cae1c643ed1ba7d5decec18834c73
AgentTesla
22a1cc0a4f9c3667870c2f7487ca8d028288806955866f32e621aadc8afe9eae
AgentTesla
3ec3af4549c4eb614c0adbe80eea39646e7b0de97e6ff1fa52c43e0fb2249560
AgentTesla
40d1d555d1d73aa499642f57619f6e749ffc9d3439841628032093af5ae8da6c
AgentTesla
6b0f2c8d4a8c8883be658db9868b33db30eb73755e4688279c29599eb25c6099
AgentTesla
7c6da3c6cdc2c4ba881925e305c2c2044105546e0b7a8ca1d8c523d8584be05a
AgentTesla
8693f1ba86dbb07d34b5043dda254c46bd8a65f46c30a45d868fa06491bacf0c
AgentTesla
b82d04c79bfd870dd7024db85a5c3c60827776af6bfd6b73306ceebf72150ba4
AgentTesla
d44ec72ea7ed650ad5ae4102ef8b60397673335a4471f2537cf6f5933cc8bf49
AgentTesla
+ 10'608 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-9sxkcz3yas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 89cc87e39f501d88416744a1d302092acda816628ba6812d5dc9e5cf2223dc3d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/385285/
  
Delivery method
Distributed via web download

Comments