MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e2be187fbfb4758e76be6dd7f3b9928f3e919ef55d45568dc1327d26f38181d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e2be187fbfb4758e76be6dd7f3b9928f3e919ef55d45568dc1327d26f38181d
SHA3-384 hash: 65bcf8c618937fd4b059e302c32b4748e34d4e222c19385abdd793befa87734c52e2c8feae8eb7620592f6962cf6d19a
SHA1 hash: 8388580ce20e6bb9b66302830bc2b7b65252c843
MD5 hash: a10c71f7e710f35f19556e6f472ac281
humanhash: social-fanta-friend-item
File name:PO#CCOR202618BAF Astra Plastique-REGARDING PMI2003024.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:565'760 bytes
First seen:2020-06-16 10:47:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 6144:K8mCRqc9c7EW/1p7fusSvvFPnJ0xIDHqhc9aC9Ya1Q+0zaMDLyz9AT3OTEW5EyIJ:KQ9c7NnbxovfDKhq110PDLyJBTpse/0
Threatray 10'711 similar samples on MalwareBazaar
TLSH 99C4E14CABED5A20D1B99B7D55BDC1008F7F799565E2F28E0E80209B05B3F729D40EA3
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10897/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sonbokli.Acl.11575.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 17:19:13 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tyv6db737ndvrz3l43ox6o4zfdz6sgppkxkfk2g4cmt5e3zydaoq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05ea9c58563a4b38dbc86c5be7ee0713a05657260b35ffba490a766c88baab96
AgentTesla
0aa602b74627829ab23af4f9f23bf6c84b6b54a64266e3efe2078869f220b75f
AgentTesla
2b23bd3f75f21fca9811b646ade99f92cbd26e4892c1f8079716d1925797edb3
AgentTesla
4febc2dad98abd9fd2428e9902020e1ffb959e672639d593db38512535ae49d2
AgentTesla
6d84b5fae748cb967181bfba0a8803f91bb47a557600be053aab1bdc70b0e829
AgentTesla
b378c93f686fd1aa1b5a01eee4baacb4b664a52714ddb6729c31204a052ee4d3
AgentTesla
e986b617ad598839ca1b5c6c38ee0dbfb289c63b8cafb009c3729ef50866c39a
AgentTesla
f15ef0ee7cdba23856a4c2bf7f9e2828a32f6d6f7fcc7261c46c6987665f8813
AgentTesla
f47aaf13e037fe6f249ef301908feb6c47825a75bf6f13075e9775de78dd2e6a
AgentTesla
f680bde2f9df0bf77497f36b16e0b1a8b08c847b4e9be02f9842e7d457169437
AgentTesla
+ 10'701 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/200624-yd768cr1d6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 9e2be187fbfb4758e76be6dd7f3b9928f3e919ef55d45568dc1327d26f38181d

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10897/

Comments