MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4845e3585066c426cadea8399468cdbcc00d5650b9c7fec25f3c8c1411141d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4845e3585066c426cadea8399468cdbcc00d5650b9c7fec25f3c8c1411141d6
SHA3-384 hash: 245dc9144992e8b2d28dcbb3811e5207b68ef13a660f16ae843b5e8402d14aae638744e4991dadf9c7d73d9119685123
SHA1 hash: 6dde720c5088e5a78d3550fd0350e03954753abd
MD5 hash: abed243ea88f1caceeb3ea76e08b8acf
humanhash: undress-cardinal-leopard-blue
File name:fwxJmsgCEbDDAuOYsjQZobDsRNVAcXnUSm.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:221'184 bytes
First seen:2020-10-13 15:16:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'752 x AgentTesla, 19'658 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 3072:qgjNLCzTaVVrv4UZrQ2442wUFB5VMoXFmZG/8nrJJAJfXVzUdrRU8wlIRXcdd769:rLYjUZrj4SUpVKnJIVopRdaIpwdO
Threatray 515 similar samples on MalwareBazaar
TLSH 54242A562714D561CB6F523DC01A820831F1E703A72AD29F5AA1D9FA1F836CDF90BDD8
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70539/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.8387.30176.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/489979
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses the Telegram API (likely for C&C communication)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4845e3585066c426cadea8399468cdbcc00d5650b9c7fec25f3c8c1411141d6/
Threat name:
Win32.Trojan.Ditertag
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 15:15:55 UTC
File Type:
PE (.Net Exe)
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uscf4nmfazwee3fn5kbzsrum3pgabvlfbooh73bf6pemcqirihla._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
7aca5ab15b62b278ebb62fe797ea2087314225836412b423514b66b93fa064a0
AgentTesla
8f416a96a4a8475bd8486d264aad1bb73ad020db8e7e1d0f268432684096511b
AgentTesla
94493ff262c556d80e0cbfd7bb7741003335e4a10f80111b2756499c6cd058f9
AgentTesla
9c2c04c0f5948c88fd2080f911ff1fadaf42102b513249ddc0ea867d71772fab
AgentTesla
9db4c4a75f04844a37e15aa0762751beed2422027496e06b76a435c953d94330
AgentTesla
b3c33339d1d526eebdd71c8ce0d1f3d0a12be1d5325e7678924e2bfc29a84181
AgentTesla
c5a6b816ef66b1c222ca59df4e8e75eed744b3d758430eef345c78e9417aa138
AgentTesla
cdd24be26b9898cde599ec3163d3b4bec147ceae656616d3a21d46fa5ab8a8a8
AgentTesla
d3473a3e73cf0e6c3d25f6631d4b4929f25f14d3997ab4a64f51530314dfb4d3
AgentTesla
dd2c1275fd6239dd194f56b78c30a226552752be6197dc22358f28e7217f3ccd
AgentTesla
+ 505 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201013-2gx57j2p52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
a4845e3585066c426cadea8399468cdbcc00d5650b9c7fec25f3c8c1411141d6
MD5 hash:
abed243ea88f1caceeb3ea76e08b8acf
SHA1 hash:
6dde720c5088e5a78d3550fd0350e03954753abd
Link:
https://www.unpac.me/results/c1b70ca5-6fd6-4117-8e56-ed8183c0c472/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4845e3585066c426cadea8399468cdbcc00d5650b9c7fec25f3c8c1411141d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/70539/

Comments