MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa0be0270d2246e7859b70b6a2d63550c6ee92b535741ec495aaf43a75a5f8af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa0be0270d2246e7859b70b6a2d63550c6ee92b535741ec495aaf43a75a5f8af
SHA3-384 hash: d4d220c2b474b8e000fe83facfcd9e423f45b3acbbda9f2d1286cd5c79a401ecf09f1afb85bc9042b52cda1ba2cac9d1
SHA1 hash: e4fbc906efd3eae76fed893c3faac93a118855d7
MD5 hash: 7f83b87f92514aa98f967dfed917c6d6
humanhash: uranus-sixteen-mountain-lamp
File name:7f83b87f92514aa98f967dfed917c6d6.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:912'384 bytes
First seen:2021-05-20 14:12:46 UTC
Last seen:2021-05-20 20:08:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:/Kjpt+9I9Ab1dtq/DaalEO8fDzDofrhUEFbqZ+TKFjS1KPlnsS:i1t+9vFqbeDoDhUHFjSwF5
Threatray 5'071 similar samples on MalwareBazaar
TLSH B31514EFAE5C6944CCF68EB0F9E453A50A6A7D315803930738BF7F89763225C8B80556
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
asus-tv.tk:587

AgentTesla SMTP exfil email address:
arinze@asus-tv.tk

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
arinzex.exe
Verdict:
Suspicious activity
Analysis date:
2021-05-19 04:26:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f9e60445-68e2-43f9-90f5-a2c5e0999232

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/159686/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.11986.25264.12000.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/aa0be0270d2246e7859b70b6a2d63550c6ee92b535741ec495aaf43a75a5f8af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-19 03:35:03 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vif6ajynejdopbm3oc3kfvrvkddo5evvgv2b5revvl2du5nf7cxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
21df0a896d06bb25d20e25f600539ca47bfd9f865ab096e486fa18d356f3de54
AgentTesla
27b11d7e95c9a02c9ff8938b12454e139a5124bd5d38b4cb04308316f0fb7e09
AgentTesla
58eca2435c0948bf856efc84e3dae7fb08305e070b36f9eee4a8def1dfba38dc
AgentTesla
5ab19cebfa4a68fb8bc8cd8dcbc5bacc63cc3f864bf48ffe545dfcca5af0f223
AgentTesla
6f56566ef4c6921224a35d837e3409a5c7f40475de7f43af9cc2bcb22d8a8067
AgentTesla
9e01f131107841c788f990a02403dffc3d7f04b4ed0ef934c3f2ccf3c1d21d62
AgentTesla
af228fc243a7e43986326e70c375d6568d2123e8a079b193aa5cafaa5973d7f5
AgentTesla
bfde7ed46df2b69b4075716cc5b1672951950c747c5f2f790013b3f1f57a940d
AgentTesla
cd0e5321f4283945ae31717c23cacd96aa8e5837908ca94ee57f96c84fdfc4aa
AgentTesla
d79ea371b04796b7433a6143387517306bc37835c4cf4c6962e0844325c018ee
AgentTesla
+ 5'061 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210520-n56xaa499n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa0be0270d2246e7859b70b6a2d63550c6ee92b535741ec495aaf43a75a5f8af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:HKTL_NET_GUID_wsManager
Create hunting rule
Author:Arnim Rupp
Description:Detects c# red/black-team tools via typelibguid
Reference:https://github.com/guillaC/wsManager
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe aa0be0270d2246e7859b70b6a2d63550c6ee92b535741ec495aaf43a75a5f8af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1191834/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/159686/

Comments