MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a54c3514e340bab0b1f2d126479b1688f1df658951dad7ce9d986b5267bb991f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a54c3514e340bab0b1f2d126479b1688f1df658951dad7ce9d986b5267bb991f
SHA3-384 hash: d647e60d7cba4523368bbc67bf3227257f42e4cf0469d0cd35d17b78674e48a4468e385a221dd962e0255f1c46859016
SHA1 hash: 5fb78596b0d6d71d6d2c6335734cde261f7a790f
MD5 hash: cccb6875ce5d1930c065bbe071c7eeb6
humanhash: idaho-winner-friend-iowa
File name:cccb6875_by_Libranalysis
Download: download sample
Signature AgentTesla
Create hunting rule
File size:786'944 bytes
First seen:2021-05-05 11:04:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:BznDOA3UbVILEhBQqdaiGTjqglzkj1yIQWs:FDOA3eVrhb3OzkjsIQ7
Threatray 4'490 similar samples on MalwareBazaar
TLSH 6FF4F1D2D6844194ED2D6F7660325C24127BBE67BEB5A50D9D8C74B02AF32C38133E9B
Reporter Libranalysis
Tags:AgentTesla


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SPEC PROJECT2021.exe
Verdict:
Malicious activity
Analysis date:
2021-05-05 10:13:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/53793b25-ef8f-4257-aca6-4b9922d79666

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/150440/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.624-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a54c3514e340bab0b1f2d126479b1688f1df658951dad7ce9d986b5267bb991f/
Threat name:
ByteCode-MSIL.Trojan.Bingoml
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 03:39:55 UTC
AV detection:
22 of 47 (46.81%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvgdkfhdic5lbmps2etepgywrdy56zmjkhnnptu5tbvvez53tepq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c4cbe5a3adfa0a596eabff32c6a43fe2f5fc2be1dcf71bddbd0c1200d7451a8
AgentTesla
2c0e7aa3bdf271a381a62095ba3398bcf46e70e1c2819e0a9802452ca5b1594e
AgentTesla
507dd7e9ab7c21513c515ff90f21a0b79b2b7b5a907c9fef6a6589308b84b169
AgentTesla
728beffcc4c6b9cab51ed5b4a459cc6f996ba0eb1a1e8c29f567de5701abcd91
AgentTesla
769ac374cd86dc2766ef985d8a462247c4b1aaef61e3d935fa8c021adb923d52
AgentTesla
be35f7a63f502853d1d202c0a58774460422759f71789cbf5240265aa603fef3
AgentTesla
df61b9c866c5ceb278e173814ddf975b70b5b2e9fcbc5b482326e4163c2e1086
AgentTesla
e3b64a79c1e0d387898d625a190d782c2ec2c144d6420a3ceba2ffb640c40046
AgentTesla
f22e2e9b137f32fa90dbb3469be393b7bae7d8c5746ba6ec28c1c6bd94005ada
AgentTesla
fc3b3ec5757f584d1fe42cbba44a0cc2f70e11f02811a074b05003230e8cb657
AgentTesla
+ 4'480 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210505-tm7ge4e4qe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
bdf79e57b5574f9bafb56f6d0592f5ee429df7eb0ad536fbdb4f2956aae36f87
MD5 hash:
826b29e2a141b055a5491c9d7dc6eea7
SHA1 hash:
af4201362b8603bf7e4b6e2ead1cfb610dd7c0a9
Link:
https://www.unpac.me/results/fe52a143-248d-44be-8a02-01f626e3a869/
SH256 hash:
a54c3514e340bab0b1f2d126479b1688f1df658951dad7ce9d986b5267bb991f
MD5 hash:
cccb6875ce5d1930c065bbe071c7eeb6
SHA1 hash:
5fb78596b0d6d71d6d2c6335734cde261f7a790f
Link:
https://www.unpac.me/results/fe52a143-248d-44be-8a02-01f626e3a869/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a54c3514e340bab0b1f2d126479b1688f1df658951dad7ce9d986b5267bb991f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150440/

Comments