MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90799ed90f14308c0bf60f347070d57b5d236cb87122ae9988145415428a391b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90799ed90f14308c0bf60f347070d57b5d236cb87122ae9988145415428a391b
SHA3-384 hash: d7f5e5d8c9b332ca92c9d5eb525af9e9cda4f7af78cdfd2cced94994702794f874f950cc95b13f426d7e5ba00f975f4b
SHA1 hash: cebfb86b1466d72d086590cb41d813015b6e0451
MD5 hash: 9b8c582760980323bb2fb58d318ecae5
humanhash: arkansas-item-solar-earth
File name:20-09-90071 Voucher.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:984'064 bytes
First seen:2020-11-10 07:22:57 UTC
Last seen:2024-07-24 19:01:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:8zIbsz22JKBVJjppD3oBzUcXYoXu+8DB21NEwqOxJ2Lzhn7epV5ljFWhOEkCMhXa:mIp2JIVJFJ3ONDudDB8EvKA
Threatray 1'041 similar samples on MalwareBazaar
TLSH E925AE84BA49F9DEC41B8F7985A62C149631297B530BE307507B74ACD92F3C38912BE7
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis9B8C58276098.7996.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90799ed90f14308c0bf60f347070d57b5d236cb87122ae9988145415428a391b/
Threat name:
ByteCode-MSIL.Spyware.AveMaria
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 04:36:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
27 of 29 (93.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sb4z5wipcqyiyc7wb42ha4gvpnosg3fyoerk5gmicrkbkqukhenq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2be641fe6ad1a60bc76261ac08484fa678c36ead721e9d84dce7ba1388a91bd4
AgentTesla
4059c5c31844e43226ec7b22e9f971aec27765e3822685e3a6b4af541fa6ced3
AgentTesla
45729be7af7c3a3c18d7b032a1797d63655fccd33c6e494a478356b55b29ce38
AgentTesla
6adc726b1fed131552f57794978c3a0ea49e8f816092e106454e73539511e9e7
AgentTesla
755bcfb03ddf8019aca959a1a5f46f1e2a8b5e10cce049ce8b80e8f4daaaa143
AgentTesla
7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21
AgentTesla
8d10af8f247bb74f1a3d0878785f3afa173c82d4c881f29dd5b60ea6ed5f6b90
AgentTesla
baded1a52a51006d751c63ebecdb3ed8f07590a7773f6a40bb4a62b8f8a09210
AgentTesla
d7105dfaf2690af5ecb82d31c891c8b6e36af889ddf4c10af513f4d0efd2d073
AgentTesla
e582696b2f3c980a6d81be401fc5da4c24a4b0c490ff6764516a0aa3e3aae23b
AgentTesla
+ 1'031 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/201110-pgyglygnga/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Drops file in Drivers directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a48902a0f56564cca494c2fd7ba5fa7325c1f58c4a673d216126615525d7b2c5

AgentTesla

Executable exe 90799ed90f14308c0bf60f347070d57b5d236cb87122ae9988145415428a391b

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 a48902a0f56564cca494c2fd7ba5fa7325c1f58c4a673d216126615525d7b2c5
  
Dropped by
SHA256 ba56db91ff23f14630183972d0f7495906d80e3fcf4fdfb313ea51dea1eb812b

Comments