MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f
SHA3-384 hash: 1a1022965b783849d27ba4d381563d21dbb07a51da7a9ace6854370837442a890e57a90ec4bb7f324eeeceaa92e1efb6
SHA1 hash: 3fa250a6565a3bb17625eaeb4db681acaebf19a0
MD5 hash: d3aa18284c0795ee7e31b88aa165e42b
humanhash: eighteen-finch-apart-tennis
File name:SecuriteInfo.com.Trojan.Packed2.42841.18110.4822
Download: download sample
Signature AgentTesla
Create hunting rule
File size:813'056 bytes
First seen:2021-02-19 14:00:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:XbZ72jA/ab7lQLvvfqeo9DlzlPtSTWsbrobDBXMBPOFsrPBvs:X8b7avBulXOnwDGBPOFsrPB
Threatray 2'724 similar samples on MalwareBazaar
TLSH 3F05F02AF790A724C25C8F77C603114893F5C393A732F3AB69E4ADE14D52F096A6F152
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118026/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42841.18110.4822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/612735
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 05:38:31 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b1fbc81d9d9e685307e80d20afe4b01c6538b903b77136b0d1db2486fe8c6e8
AgentTesla
5bbde3f5d6db7f3be36f4f0f08c86fd412a1c6085c5be438be7f1e9e181e3683
AgentTesla
5defd50046db301c82c85cc8306960982f576cbf5446f24062cc570dcf0becec
AgentTesla
69f4101e63fdfdec4a5b6fc4a778619a69f9511416dd90fe9df33502ff8d9d4f
AgentTesla
7083d07e76ede7df53ab72e7b1b3b7147ce97b81d89152838b15833c68fb5de3
AgentTesla
8db06aca14a39bea41ccc392fa7e7468201a73c4bc8f9302b38515e1fedf216b
AgentTesla
ac4bc198b74ee90e9ae296353856fe12fc688a42bdeb2b8b9b4f6c2923cd668a
AgentTesla
bc58f1f37527b2256089b3fedbf5044ad396b267a762ca7e7f6fa7c81f76259b
AgentTesla
dba3f68edf7d08561f4e0b50494662fe7aa12c6b40fd2dede06bccedd43498b0
AgentTesla
ef715cd322f0a805a68840b215c062f2e254977170a11c6800d836eac781fabb
AgentTesla
+ 2'714 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210219-lywjdjbz22/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f
MD5 hash:
d3aa18284c0795ee7e31b88aa165e42b
SHA1 hash:
3fa250a6565a3bb17625eaeb4db681acaebf19a0
Link:
https://www.unpac.me/results/831ceede-8b22-4902-8d07-c11a347b427e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/118026/
  
URLhaus
https://urlhaus.abuse.ch/url/1019230/
  
Delivery method
Distributed via web download

Comments