MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ac9239da18d97131d83ae2d9a24cbdfc0c4f5c232bb04bbeb0e6931e9ac5cc98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | ac9239da18d97131d83ae2d9a24cbdfc0c4f5c232bb04bbeb0e6931e9ac5cc98 |
|---|---|
| SHA3-384 hash: | f2f50ca8d3ce5de1db50d38f2571eacf3f876c6f99b128e20efdd427067b158fb3d31a78b5003951fb01091303817e31 |
| SHA1 hash: | 8cfe63d7cc6d7f5057ba7c8b8b53583755f27fb6 |
| MD5 hash: | f0ae13710d5efb19bd9a4de5c190e13b |
| humanhash: | helium-lamp-gee-spaghetti |
| File name: | f0ae13710d5efb19bd9a4de5c190e13b.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 573'952 bytes |
| First seen: | 2020-11-17 07:13:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:b8rDbcjb4X7L78Fri/R4WBqzgrNWQmcT/RsCu5GBbggdo4huTa9Wyunv/zGJH4:b8rEjbUL/RBBqMj6bGPdo4kwuvg |
| Threatray | 562 similar samples on MalwareBazaar |
| TLSH | 4DC48EB23D92587ECA6B0775517985C0FAB61AC73FA08B0D71AF430C0F21A1BAB53657 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
AgentTesla SMTP exfil server:mail.spamora.net:587
AgentTesla SMTP exfil email address:
sales@jiqdyi.com
Intelligence
File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a window
Running batch commands
Launching a process
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Signature
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Add file from suspicious location to autostart registry
Tries to detect virtualization through RDTSC time measurements
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-11-17 02:32:53 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
+ 552 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
6e7156ff4287bf6a83d88eaff1c4e9ff586b2ed9a6265d6e98c5e074eb025282
MD5 hash:
8778cdc547a743aed714afea5d1227af
SHA1 hash:
b12215c2b847aea0aa5e1158fa69072bad2a985d
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
1cef5a9856a022b068034da55aa6ce8d9d1a9be052a26ba3e248d54d7f7cc030
MD5 hash:
e8a64d65d1da3ac009392060f30cf2b7
SHA1 hash:
fbbf6d66caf4f9f6f36b91e4ff22b78a7cad4338
SH256 hash:
ac9239da18d97131d83ae2d9a24cbdfc0c4f5c232bb04bbeb0e6931e9ac5cc98
MD5 hash:
f0ae13710d5efb19bd9a4de5c190e13b
SHA1 hash:
8cfe63d7cc6d7f5057ba7c8b8b53583755f27fb6
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_extracted_bin |
|---|---|
| Author: | James_inthe_box |
| Description: | AgentTesla extracted |
| Rule name: | AgentTesla_mod_tough_bin |
|---|---|
| Author: | James_inthe_box |
| Reference: | https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/ |
| Rule name: | Agenttesla_type2 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Agenttesla in memory |
| Reference: | internal research |
| Rule name: | agent_tesla_2019 |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | CAP_HookExKeylogger |
|---|---|
| Author: | Brian C. Bell -- @biebsmalwareguy |
| Reference: | https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
| Rule name: | win_agent_tesla_w1 |
|---|---|
| Author: | govcert_ch |
| Description: | Detect Agent Tesla based on common .NET code sequences |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.