MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164
SHA3-384 hash: 370c704ff34b4b55c90c0e4174c833ce5c1c35a87e4701f5628797b3468acec391debe28f2a13ac0ea02b6b979eadc45
SHA1 hash: a6405b39bcf1929f85c3623b8ee0cafb1f63ca1b
MD5 hash: 1d2110950be86f52363fb6a000b4c44a
humanhash: lithium-angel-lake-equal
File name:1d2110950be86f52363fb6a000b4c44a.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:24'576 bytes
First seen:2021-07-23 06:21:40 UTC
Last seen:2021-07-23 06:58:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'631 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 384:D72vWqIRMDkNdR/j2VTDaL2Eao2s+bxE8ap9uiH7KchZHPI9RfIKkOXzPUrhmzgx:D7GWq/gj2q3ai9vH7HQPAo5NvhP1Sre8
Threatray 7'269 similar samples on MalwareBazaar
TLSH T1C2B26C62BEC9207FC58D02730471D7410A78EB9E1416EA45C9D0493A9F63B6E9F63BA3
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1d2110950be86f52363fb6a000b4c44a.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 06:40:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/22a58422-27a2-4e44-8620-14327423f9fd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173532/
Detection(s):
SecuriteInfo.com.Trojan.MSIL.Agensla.ic.27416.8887.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e1f0c4f-d5c1-439e-b142-bf99a63896e3
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/820562
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-22 13:47:36 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=txgt7ziksejxs6f7nhzzs3ipumzw6htdioriimk6hstgtcytcfsa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
350b31699cc2a188797aa30da41b3a5c4050b091335c7be16f237f7f66ec9e7e
AgentTesla
4ca6a1195608a6206f231d731094ee7a6b063d6acd5350709fb6a3c74e0dd627
AgentTesla
6da426505124521e6a239d113a011f7c04d6dd6160eb03f324e6a0483f7695c2
AgentTesla
a6e9b29c704be52956d000ed59a713ef42e190182debdb7019c064bec40cee59
AgentTesla
acd7329f6a182c9bfa1b899cf41933c93a6d0403abc3c99741b79c6bd81d6816
AgentTesla
e45f8186d5e8e6429af257e0d1b5a6de36cf68b4b5e8336600ca9c1736f3d8d0
AgentTesla
+ 7'259 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
suricata
Link:
https://tria.ge/reports/210723-2ptrp22fw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
suricata: ET MALWARE DTLoader Binary Request M2
Unpacked files
SH256 hash:
9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164
MD5 hash:
1d2110950be86f52363fb6a000b4c44a
SHA1 hash:
a6405b39bcf1929f85c3623b8ee0cafb1f63ca1b
Link:
https://www.unpac.me/results/a8bd2097-e19c-457c-bab6-8cda78d802e2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 9dcd3fe50a91137978bf69f3996d0fa3336f1e6343a284315e3ca6698b131164

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1430278/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/173532/

Comments