MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949
SHA3-384 hash: a4feb9308bcbbc8bfb7c1bf84f2665e6b0caa997afab7034461dd1627e93ed5346274c802a041a92f8de9791b2753b9b
SHA1 hash: 76d62a638598aaf315030c3f8c21afff1b0a6cb1
MD5 hash: aa7bc1c91e5d0436578c580662fc3253
humanhash: three-wyoming-eleven-king
File name:yevIa4Z99KSppE9.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:433'152 bytes
First seen:2020-06-18 05:34:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:xLc6eTR1oV5xbW2k/sYVqgtz7yln1+Rm:xw6K70fbQEYV5tz7yF1+Rm
Threatray 10'717 similar samples on MalwareBazaar
TLSH 9494F14676DCC711C17C5A3EC8E7485003B8AE933662E31EBFC937AD29527E3580679A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.beeinspire.com
Sending IP: 115.124.125.172
From: Prakash International Pvt. Ltd. <raj@prakashchemicals.com>
Subject: Hello Sir/Madam
Attachment: New Order_pdf.rar (contains "yevIa4Z99KSppE9.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19603/
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 04:12:19 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vguq4mrnaq6pmqypwbynft4b5i4lg2yxjlovwbwd3bury3dalfeq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
119d0e520473bf8e440f8d993206427b0379497442c37b4388419e19ae498056
AgentTesla
3b42a378cd7279c28767cf421cd3dec7562e5880bc42b3b9079303849e3e62c8
AgentTesla
4b529e559d9475663c5692e704baa304e1bc8e2542684861277004f5ed91b634
AgentTesla
540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb
AgentTesla
586f0575efe94c03789c8e0f129b1eeb88f017a5f3ac3c3d3d9d3407ab0600ae
AgentTesla
75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a
AgentTesla
7d1090ba9b026dcb58c9663b738214ff170b0dfdb10ebb2d33e3806b9ecf2990
AgentTesla
867979993b4e58bf11e73e11655e50ca97b55e91322e744b29241d3a47b7dcd2
AgentTesla
e1edaeafb526cd694a3f293cf47ad4bdb832cc0c6d697a1f386d0f9b63dcd152
AgentTesla
ee68f4182a48125bc3080933bb79ab52471dde90d54bbddeb44cc6163ebf9fb7
AgentTesla
+ 10'707 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200624-bhbwns3k26/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4d10b33131c659ac8c99c0522ec797ab83a6a5b4d6c6d9c13d659d2a08ad12f

AgentTesla

Executable exe a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949

(this sample)

  
Dropped by
MD5 6551dee28892cf419f5aa5b2c6991594
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d4d10b33131c659ac8c99c0522ec797ab83a6a5b4d6c6d9c13d659d2a08ad12f
Cape
Cape
https://www.capesandbox.com/analysis/19603/

Comments