MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0b6256a49a8f7f4c2d1d362f49b996de971d49e852a0c58e7e0c821e99821ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0b6256a49a8f7f4c2d1d362f49b996de971d49e852a0c58e7e0c821e99821ca
SHA3-384 hash: 11bea0202a5a10f9e657d1ac34c758ced03bf830b7cbf362081fdd65913a26a537a5685110646de1c8444016dde19ea1
SHA1 hash: bb6517db8a55b732975cfcb0e42557338d0fd239
MD5 hash: 46fd7496c716bb2334cd992079d2723e
humanhash: robin-echo-cold-lactose
File name:46fd7496c716bb2334cd992079d2723e
Download: download sample
Signature AgentTesla
Create hunting rule
File size:679'936 bytes
First seen:2020-11-17 11:54:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'633 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:SbqigOhiquILEn5SuLvdAtuI2S3XYGndoJ1X0X2zKsGCZtD01:StG5SuzdzI21L1T2p
Threatray 1'324 similar samples on MalwareBazaar
TLSH CAE4BE1863C98D09F0BFDA3656B121910FB6BAD3FB52D15DDCC090A72DA2F81CF16266
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Adding an access-denied ACE
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Enabling autorun
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0b6256a49a8f7f4c2d1d362f49b996de971d49e852a0c58e7e0c821e99821ca/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-08 02:00:00 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uc3ck2sjvd37jqwr2nrpjg4znxuxdve6quvaywhh4decd2myehfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0626455807fad5c69df5158b623b2046f376024449d78dccc8c8c96c8ddc3614
AgentTesla
08f9ff6bbe01d3fab54974c872fbdf2f8fa1fd1f32649c776f0626030169272c
AgentTesla
13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
AgentTesla
1e3772fb826af045d4d6aa5943be1c66bfca44858adaee941606ebce680373d1
AgentTesla
31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57
AgentTesla
5952cc403a58eab272b199a6f39c35bfadf8feeafbadc1a3d30a68e01e93b7ae
AgentTesla
639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392
AgentTesla
c2330695f7393018b464630da587c9d2ff1cf9d1304f32dfed1b32f0037b78b9
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0
AgentTesla
+ 1'314 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201117-s46xncqjc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Modifies WinLogon for persistence
Unpacked files
SH256 hash:
a0b6256a49a8f7f4c2d1d362f49b996de971d49e852a0c58e7e0c821e99821ca
MD5 hash:
46fd7496c716bb2334cd992079d2723e
SHA1 hash:
bb6517db8a55b732975cfcb0e42557338d0fd239
Link:
https://www.unpac.me/results/c82eaa04-05f6-47c2-acbb-1873fe504d75/
SH256 hash:
fe069f67f034bb54b04b66a486bc4f288260951dfe7ad175354a36ea9ddbf8f3
MD5 hash:
a2f0e1d6cfcf06a89860d917364f8ba2
SHA1 hash:
b421c3485edcf6f9bec2afde8d7a4e23be4f2e34
Link:
https://www.unpac.me/results/c82eaa04-05f6-47c2-acbb-1873fe504d75/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments