MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a02051e8bd0706ecb404bcc7df771bc035228890fc2ac09e1b2d02e686136520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 9
| SHA256 hash: | a02051e8bd0706ecb404bcc7df771bc035228890fc2ac09e1b2d02e686136520 |
|---|---|
| SHA3-384 hash: | 8b81d8c1dcc36c281aeb5166ed984c9d0f7c1c0159544d4666ac475571eb76b0ebd1db372a9d343f75e3d34f1122f690 |
| SHA1 hash: | 06beac9aae72dbada921ed7cfa1f211446e1cdb1 |
| MD5 hash: | 6dab2d429fcbfbf372068e3681b756dc |
| humanhash: | jersey-red-may-alanine |
| File name: | nsDv6PZh6gUoltD.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 601'088 bytes |
| First seen: | 2020-10-16 12:55:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 12288:4rwX+JCQptPoNm/SKKV+/rf2AaoX/KLIX6SPMpxKG9qMzY:QwXSPow/SjV+/rf2Afvuy3kphLk |
| Threatray | 605 similar samples on MalwareBazaar |
| TLSH | 88D4CF31B689AF14E07E573794F410A453FEED05AB62C52F3CE136EC5961FA44A22B0B |
| Reporter |  abuse_ch |
| Tags: | AgentTesla BBVA ESP exe geo |
abuse_ch
Malspam distributing AgentTesla:HELO: mail3.ebond.hu
Sending IP: 217.65.100.159
From: Confirrmig.bbva@bbva.com
Subject: BBVA-Confirming Factura
Attachment: Factura.PDF103.rar (contains "nsDv6PZh6gUoltD.exe")
AgentTesla SMTP exfil server:
mail.crealuz.es:587
Intelligence
File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-15 22:30:02 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 595 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
a02051e8bd0706ecb404bcc7df771bc035228890fc2ac09e1b2d02e686136520
MD5 hash:
6dab2d429fcbfbf372068e3681b756dc
SHA1 hash:
06beac9aae72dbada921ed7cfa1f211446e1cdb1
SH256 hash:
b135269543cf8e8df479a56e0f7e067c71871488976cb9d3c2930d82b14372ec
MD5 hash:
c11778ba110f5737a73bacd90041fde9
SHA1 hash:
015ec30f365f940184ab042d54702ef1018730e7
SH256 hash:
58e4e1a0c8e7a822c7e94693ed7663ca46b58d08036221b87c0cf236c98ce0f9
MD5 hash:
63202876acd6f7842ef501f203b5e4e8
SHA1 hash:
3de4f6f202221a34d58a0cc8c284226340d829c7
SH256 hash:
a7ec0fa0f276421ecbbb6939c41ab549ff53f396c931457664150b1cd6e5abd4
MD5 hash:
32b29a1a8671b65311c52d094619f0c5
SHA1 hash:
47f87f9c92cafb0084e50ce9694b13160818c41e
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_AgentTesla_20200929 |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.