MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb
SHA3-384 hash: f1a8e411b752420cab1ba9a0adc480a5e9b5c65cfe99e7437b2a930ae835e3af38aa4610aaf9a13c1f2ea282329100bd
SHA1 hash: 702c42942604d2eb72dc324e4b8604410e07cea7
MD5 hash: e3306e332bb263b855722a4605905e76
humanhash: carpet-princess-friend-romeo
File name:INFORMAC.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:749'568 bytes
First seen:2020-11-13 14:01:18 UTC
Last seen:2024-07-24 19:43:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4ced342d7fe3a12da5c7eca8fa03d75b (1 x AgentTesla)
ssdeep 12288:E9zJO6rTxDXicxNF0f4TQZVvOXL0QYSxmr3rrXtY5:MFTxDLFLQ/vOwQ27rXtU
Threatray 1'166 similar samples on MalwareBazaar
TLSH 5CF40503A86C84B2EE35533E05554DD991F82C5C07C9B69B53B8BD3DCA3C4A16D2FA2E
Reporter Anonymous
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/533893
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 14:02:07 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6vk56blws7gbzs6ogbl7aav2krf7n5sz3hvt4cxh43pzsddl3vq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
160bb1d1ffcdea76c664adfeed64f6fe3e16285baf9c4336ebb0caeddfcfd931
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
3b8067fda3a018631e93bcc5e5ab73c56adc91c4964c45c092d42f2cc9acea6e
AgentTesla
642dfced9844802f4388b3c2f30e08d9a1c94f2507e7277d900756b284d37ca1
AgentTesla
6b75182568a1cf2fef851977be460536fe4a0af4aaf05b41a253c53f2af276fc
AgentTesla
7323b8d5a71d744ada47370e02c8d86eb551bacb6881aee27ed7ec61cc22e068
AgentTesla
b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
AgentTesla
c754f76eefb0ac8ba7da335bbdc3e50ce786a331f41056215367418fca46c1a5
AgentTesla
e4a41177193fe8cd0c6113402e16b6be355a08baed17e525019ff02ffd8884a8
AgentTesla
+ 1'156 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201113-ybejasrwe2/
Unpacked files
SH256 hash:
9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb
MD5 hash:
e3306e332bb263b855722a4605905e76
SHA1 hash:
702c42942604d2eb72dc324e4b8604410e07cea7
Link:
https://www.unpac.me/results/40ee0618-73b7-43c9-9bad-609b5eeac7b5/
SH256 hash:
f8621c9abc15c0d08e78357b918b4e277d6ed7832c2af1aa3ed6525e09e43e74
MD5 hash:
39f280c8fa9e86444fd84ebea2baec21
SHA1 hash:
2117b021f7bd7491f1d352074f5ea5f746b2c590
Link:
https://www.unpac.me/results/40ee0618-73b7-43c9-9bad-609b5eeac7b5/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments