MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16
SHA3-384 hash: dd318ff0fac0d887d0541a02347fb0689a964cf607d91ad7cb34a2ef5fb200dd4fcb1926d907a207443fc72cd9e83249
SHA1 hash: 59fd5fbd934d87d742e133a89a1d12f8efbca15a
MD5 hash: 487d51bc5f6ca4125b438ed46e7a0827
humanhash: solar-yellow-hawaii-leopard
File name:a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'504'256 bytes
First seen:2020-11-10 10:59:52 UTC
Last seen:2024-07-24 19:49:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 24576:N16o4fQSYbrcOoSNivEGBJErUMfMcFfnuwCChHwDb4l+0EdCu4Ad++++4++++++A:qoEsN9GB2Alqnm0HwD284lQ++++4+++h
Threatray 1'660 similar samples on MalwareBazaar
TLSH B065ADA0A3819586C51F0A3B9A16FC30D2136F6595FAD28A53DCBC6F3BBF3090591B47
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:01:29 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uipdr6hwxzoknljdla23rh3xjykcna3blnn6yz35ht2j7z4mf4la._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
275537d87441c354b859273e0729177d78f185bebdd9a86fac240a3f168a80a3
AgentTesla
28823e2dd26833e6b8c4b3e1988dcf44ae38794c20c9ce8adaaf60106652ddf9
AgentTesla
453e22919069356ebcdd0761b215364026ac41bbb167a590295bb50dbb30be93
AgentTesla
5312fab3ad83a00863c90baec3bbe7f1265cc6d94398b364f2cd7c11369af074
AgentTesla
53af62936f7cb4fcbcb2775be40606aed87def8af75821520ebd857dc91370c1
AgentTesla
6f2ed9ee33724651d7fb52edc4dbb3bfde3c19ca12cf5e990952d392305d1c20
AgentTesla
9ab48a539aad8c6729c441a0a32ad02039802420bada44d2bf8aec052255dbde
AgentTesla
d5132d40838a12d557fdcea3492cbe6775330dc7298bb806b076011816fe1f36
AgentTesla
d83429370b6d814b6ff67dd1736424db4e11e39ee745867f09c98f49fae4e1fc
AgentTesla
ff9861dd2b7ce7f396ecbcbbdbff007827a32740243b1b3a848c2566ab32fa59
AgentTesla
+ 1'650 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201110-w5vgwfer6j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16
MD5 hash:
487d51bc5f6ca4125b438ed46e7a0827
SHA1 hash:
59fd5fbd934d87d742e133a89a1d12f8efbca15a
Link:
https://www.unpac.me/results/923b3e9b-515c-4642-a71d-6434bce44880/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/923b3e9b-515c-4642-a71d-6434bce44880/
SH256 hash:
c0b77a996421c2e5070836d8ac7077302a940348cd78d56f3fb2268e39a4f11e
MD5 hash:
88dfffdc06f3bceed6f25ea59b12b335
SHA1 hash:
32e19a4f64be77b47da8b45583a04c9164742747
Link:
https://www.unpac.me/results/923b3e9b-515c-4642-a71d-6434bce44880/
SH256 hash:
8e55f8d587b6b9f7f721cebf05ec05be8bdfca600fb4329bbcdf21da58a79bea
MD5 hash:
00efbb1daa9c2a59cc43306c08750a43
SHA1 hash:
a23a2cbae593b2720a5e0164c570ddf5ba8dc70b
Link:
https://www.unpac.me/results/923b3e9b-515c-4642-a71d-6434bce44880/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments