MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bb96bc7a886ac113b6fbbd8c07e7e6629fc695d7558a28cb8b0fa6c77ce9100. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bb96bc7a886ac113b6fbbd8c07e7e6629fc695d7558a28cb8b0fa6c77ce9100
SHA3-384 hash: 10aed107c18081d0b63c2aadb435fffaed0b20457d9ac8bc6e3c8d05816ecf9cb400da0421757c5782d4ade932c7ab7a
SHA1 hash: bedfca5ff03f4cc4eedc1892598043d1853f0d94
MD5 hash: d7f683a90316b309cf3b1f083ef7bd2e
humanhash: august-monkey-twelve-queen
File name:Port Inquiry for discharge 2000mt.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'124'352 bytes
First seen:2020-11-05 08:08:48 UTC
Last seen:2020-11-05 09:35:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:+EsfCyXXJuIJFJCN+K3nNWHKp2AkApFl:Pw/X1JDC/3NFp2Av
Threatray 957 similar samples on MalwareBazaar
TLSH EB35C0F5A142D69AC81F083FF84B256183EACF2D99F8854593C5F22D137D2CE56AC48B
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83095/
Detection(s):
SecuriteInfo.com.ArtemisTrojan.6605.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/521030
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bb96bc7a886ac113b6fbbd8c07e7e6629fc695d7558a28cb8b0fa6c77ce9100/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 05:37:35 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ro4wxr5iq2wbco3pxpmma7t6myu7y2k5ovmkfdfywd5gy56oseaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
3b8067fda3a018631e93bcc5e5ab73c56adc91c4964c45c092d42f2cc9acea6e
AgentTesla
3c85e3f78145e29fc8f45fb72d497f856cc1dd054d34d2588d306cb96f30e29f
AgentTesla
6853956661336de789939b113160c9316bc33c213c6633cc98636f107616e538
AgentTesla
6b75182568a1cf2fef851977be460536fe4a0af4aaf05b41a253c53f2af276fc
AgentTesla
9c2c04c0f5948c88fd2080f911ff1fadaf42102b513249ddc0ea867d71772fab
AgentTesla
b3c33339d1d526eebdd71c8ce0d1f3d0a12be1d5325e7678924e2bfc29a84181
AgentTesla
c5a6b816ef66b1c222ca59df4e8e75eed744b3d758430eef345c78e9417aa138
AgentTesla
ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6
AgentTesla
ed0e31210d186d28b6ebead24d3c9721807d8cbc3bad6c2da8f8f7a4f53bc238
AgentTesla
+ 947 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201105-7vqkbc8qza/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
8bb96bc7a886ac113b6fbbd8c07e7e6629fc695d7558a28cb8b0fa6c77ce9100
MD5 hash:
d7f683a90316b309cf3b1f083ef7bd2e
SHA1 hash:
bedfca5ff03f4cc4eedc1892598043d1853f0d94
Link:
https://www.unpac.me/results/63a72f33-4b84-4ec9-b02c-05ce1702a006/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/63a72f33-4b84-4ec9-b02c-05ce1702a006/
SH256 hash:
ada3a6caf7587830d988e0fc39422e5414bd72894701f2fc5e4c0603c2cadd26
MD5 hash:
c6e2593534a9754277600181ac359fe5
SHA1 hash:
9804176256d867d0faaae83dafc168c2e1d7cc0e
Link:
https://www.unpac.me/results/63a72f33-4b84-4ec9-b02c-05ce1702a006/
SH256 hash:
a8fb7e57db60b06e1257c1ddba63cdbd30a541bec0d4f3775467112b317ebc2e
MD5 hash:
51d3baa25ddc6b7f52935af8bf8e69ce
SHA1 hash:
e6f1a09ce1c50733523c9a766cab5e73302713a6
Link:
https://www.unpac.me/results/63a72f33-4b84-4ec9-b02c-05ce1702a006/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83095/

Comments