MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0ab439553d3bee9b31115fa8b106d1ba6622b4b7c97e695814ed8724d52663e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0ab439553d3bee9b31115fa8b106d1ba6622b4b7c97e695814ed8724d52663e
SHA3-384 hash: 292e829ef2cfd13ed19c3ab53f943a9378b788bc4fe709ea8a89ac769d08cdc92e3331f0f561000cee6b030143844c37
SHA1 hash: 4500323278be349664a9f45e23902c37e90953a6
MD5 hash: e4ce3864d8c2ad294eb8c9efc93d0d02
humanhash: artist-nuts-eighteen-carpet
File name:Inv docs.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'592 bytes
First seen:2020-06-12 09:42:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'481 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:eBSbSYhI7VsNei+SWaMxgrznXI8LOkgSp7Av:e6S78etfWrFLP
Threatray 10'922 similar samples on MalwareBazaar
TLSH 2894F14D37A0B2EFC86BD972CD581D20EA28B4764B0BD31BA45316ADAD4E5A3CF111F1
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10026/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.931.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 09:43:07 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucvuhfkt2o7otmyrcx5iwedndotgek2lpsl6nfmbj3mhetksmy7a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
7666a9640caa1cd3032c124ae3b763f280cae9da5028586721e3aed9f476bf2d
AgentTesla
8daf58146648177ecc0b8da2ee4068ef7886065792c7f6fa9eb03fc77c041e83
AgentTesla
ad47a95274571e9bb73b9afeea618dbbbcf5c859b422b14a5d307116d98b7f9f
AgentTesla
bc02f7f4317f67dcc9ef60b524498431ec0ef0b261f715c4b20371e423b30fb5
AgentTesla
c2a3baf11e6dda4c99e5ec516fe3bdfa0717a1383ca08468ec00ef6f41c8ef50
AgentTesla
c90e8c00718440709f2a708d2144adb877b2908b024e7a94bc20b4f9eb0ee92c
AgentTesla
da17b064bf15e59d7b4866980857a224501221ba8540003d2e69ceed8f6315e5
AgentTesla
e4a95445ff5dddd4211458a130f22eef7295501a4d3bab11b9f13a4f1c689eb1
AgentTesla
f20b3dc32d42f2f1a64414b5932cc0cb7baf99356445a770a80bf7bed7e144a8
AgentTesla
f6e9e7b2c851a45cf6cadddf0d3481033fc84e0d6f1bbf817f70cb2b837aeecc
AgentTesla
+ 10'912 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-jydea3646a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
AgentTesla Payload
Looks for VirtualBox Guest Additions in registry
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e56a1788c8b4120c06839d53de2a96c46b0be9e20c546c387109508f4b0a57f

AgentTesla

Executable exe a0ab439553d3bee9b31115fa8b106d1ba6622b4b7c97e695814ed8724d52663e

(this sample)

  
Dropped by
MD5 c6bd64208ba22ceed24dc54bf09da298
  
Dropped by
SHA256 9e56a1788c8b4120c06839d53de2a96c46b0be9e20c546c387109508f4b0a57f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/10026/

Comments