MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bc1b60515f614f9830515fe1cfdfc042522256ce84befe0719ed1ecafe5fd07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	9bc1b60515f614f9830515fe1cfdfc042522256ce84befe0719ed1ecafe5fd07
SHA3-384 hash:	5added0766c38f48aeeadad705baa0521b3e2e69e665237c89d768779a5048754dd092df4ca4a7ca664545fc62a58480
SHA1 hash:	b8a53841701b6b0a4f3b96f1dc9af57598572cf2
MD5 hash:	965b8f34a079715dc15b7a5aa8d4ebb9
humanhash:	uniform-lactose-twelve-illinois
File name:	Bunker Form 1.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	916'992 bytes
First seen:	2021-04-30 06:34:28 UTC
Last seen:	2021-04-30 08:40:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:pMZgMk5LblUAkXO5br5mo/WfVvA2HGc6NdYxw0XK7Z9ZLS/oaLS0:yZMKAkXO5r5mkOkPdewt7Z9ZL+oaLx
Threatray	4'329 similar samples on MalwareBazaar
TLSH	2E15022637D4AA19E03E1BF519B0468053F8F9462A21D61D7D98635E0FF23E1CB773A2
Reporter	GovCERT_CH
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/147220/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.688-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/704120

Signature

.NET source code contains very large array initializations

Found malware configuration

Injects a PE file into a foreign processes

Installs a global keyboard hook

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9bc1b60515f614f9830515fe1cfdfc042522256ce84befe0719ed1ecafe5fd07/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-04-29 14:29:41 UTC

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tpa3mbiv6ykptayfcx7bz7p4aqssejlm5bf67ydrt3i6zl7f7udq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

38a28c23a06bd4d76b939f80a9d771869474f6570c1879da4ba7b6561efb5f11

AgentTesla

5ec1e61f1b16385377817460f00e7efc8cdb2d45b625a165f4d62bab276b0d53

AgentTesla

6dc5759e0f8a3b5c7da77d3057152b5142ce784265a9cdc6b97d8a7d34bc2cfd

AgentTesla

8a8277aacb3fe8501802b00b3cf5d674776f4050c9caf0fcbbaa977b48966215

AgentTesla

982f78486c92d9a057765b69ff096bbaed9a0b8ef5e0e320f7d9c465f82575be

AgentTesla

9ea4a4a25a5cda6ab988055c5172dc2993acc05dcb480f9007d52b188b7d44c7

AgentTesla

b40ad65591265e4e41072960963f3c4471b009dd8cd24972bee44dbaadaf1b0f

AgentTesla

d505ede300f913499d3a5709f80b8ab6266c631f72f2b74a13f18d2fa9337248

AgentTesla

dbb97dbd46f947a190a1fe6d12ad7e959242a52832d0b402beea30e52ea76ef1

AgentTesla

+ 4'319 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210430-mrlh71vy5a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

11cf5a51e593c007ff4f91294cf505ffd5e425e56387c60d81e6479cc284cc3b

MD5 hash:

73cc3f7e7700e6a54cb5f291dffe5aa1

SHA1 hash:

09174f9fa55c9bac0540efb7a8c682878a32d02d

Link:

https://www.unpac.me/results/6c9f5a92-5665-4c30-85d3-0ccb3827485d/

SH256 hash:

9bc1b60515f614f9830515fe1cfdfc042522256ce84befe0719ed1ecafe5fd07

MD5 hash:

965b8f34a079715dc15b7a5aa8d4ebb9

SHA1 hash:

b8a53841701b6b0a4f3b96f1dc9af57598572cf2

Link:

https://www.unpac.me/results/6c9f5a92-5665-4c30-85d3-0ccb3827485d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9bc1b60515f614f9830515fe1cfdfc042522256ce84befe0719ed1ecafe5fd07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_AgentTesla_20200929 Create hunting rule
Author:	abuse.ch
Description:	Detects AgentTesla PE

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time