MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 967f7f10626329bdb9c7f0ed10d64ffc0fd3fb01f3cd032ed50cab470a2840ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 6
| SHA256 hash: | 967f7f10626329bdb9c7f0ed10d64ffc0fd3fb01f3cd032ed50cab470a2840ce |
|---|---|
| SHA3-384 hash: | 31a66995d627c8f02ee588d42c7c43f5362094fa8d5a55319594b1e45f2684435b5e9952e52554b83f5ee314d196b61b |
| SHA1 hash: | c45e74ee241d45f6338a16d43373ae44fcfbe8e6 |
| MD5 hash: | fc3f08d788c4cea4c0482cca592aad37 |
| humanhash: | beer-black-double-network |
| File name: | fac.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 602'112 bytes |
| First seen: | 2020-11-12 10:46:41 UTC |
| Last seen: | 2024-07-24 19:17:12 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:IheXfyqcJ+eAAHffTK2QFqzK5ZuJWQim3ZHiSA9a1BCr9:BXfyqK+1A322X+56WBS6abCx |
| Threatray | 1'128 similar samples on MalwareBazaar |
| TLSH | 63D4129B4379D71EC7DA66BE9132030242F295543712FAB89E49B0C73D037D161AAEE3 |
| Reporter |  JoulK |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
3
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
76 / 100
Signature
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Malrep
Status:
Malicious
First seen:
2020-11-12 10:47:05 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 1'118 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
spyware
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
967f7f10626329bdb9c7f0ed10d64ffc0fd3fb01f3cd032ed50cab470a2840ce
MD5 hash:
fc3f08d788c4cea4c0482cca592aad37
SHA1 hash:
c45e74ee241d45f6338a16d43373ae44fcfbe8e6
SH256 hash:
2abfe1b0839d1e1641cf61f6b41930ab1dce802098db0c8725a0504197597cfd
MD5 hash:
14f75f5efcc44232563291cbe2fc8654
SHA1 hash:
0e1c780bd0fefa10f05a5b1a007c171ea53858d1
SH256 hash:
894500ab169d0e33db311ed4bbb1c1d622f3d6ababa35656c0f0c75160e89b53
MD5 hash:
b57cfb671d0ea8d214722a40e9d40f8f
SHA1 hash:
c8e6083a577341874fa46f809e4d808e079d6718
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_AgentTesla_20200929 |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.