MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0
SHA3-384 hash: 49910624b10e39769d8b0af6b1321d824b0828976e944fb47e6f46767717945367c860f28bbb18e9b31097701f09ee38
SHA1 hash: 74562f103361fd83ad22318dba4feccf66ea2a6b
MD5 hash: 757d71487eb594f05d2fd1d63ac18de3
humanhash: august-network-nine-ten
File name:Kopie des Zahlungsauftrags.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:79'360 bytes
First seen:2022-02-09 12:12:01 UTC
Last seen:2022-02-09 13:52:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:K+sb5c32p5ctkpHsRYmDHG17buz3olfaN:K+sbG32H7pMtGiYlfaN
Threatray 19'427 similar samples on MalwareBazaar
TLSH T195739E243584ED24C93CD43408A2F15F0E79B472BED64B97F9AC429F0E156C97A2AFC9
File icon (PE):PE icon
dhash icon dcd8d4d4f8f0b4f0 (1 x AgentTesla)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/239512/
Detection(s):
SecuriteInfo.com.Artemis757D71487EB5.1125.9243.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Running batch commands
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/6203afa1c79b424d720ad241/reports/95c74c32-8766-458b-a5ac-2c304959346a/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/352dec5e-b14c-4f2f-8406-72a127c55456
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/936827
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0/
Threat name:
Win32.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 12:12:17 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
16 of 28 (57.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vvwlw6jz7cbe2lrnka3hhto5t7iev7qpc63tkzodk7h4tmeatdqa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a7682c0607e0fcb3580d28aec0e3439d6eae0cde1ab3359832046f7f33cdb0f
AgentTesla
245f10bd87db63dab02528af1be27f84be2be58aee091227a3c3b5c4373f08b9
AgentTesla
4bb6d08dad879c7e0098024d645c92c198484e1d7703019fa0db7ead6f867bfd
AgentTesla
599ae5be5a7d40330aa098c54721609fcbd05039755904015fab880b4b8502b9
AgentTesla
5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd
AgentTesla
a5b4a1aa53134e93a392b7b90cc7c5d4a939d4f61bdf330de08d49fa1b4356ed
AgentTesla
c2672e6fd55b129125a19c7837943c0844c03ec02dcf165af183f9e4df4dccbc
AgentTesla
efc33e49a1f2bb8a2caf20a3609c44170c3739c90c1e2f4f236961e13279a3b3
AgentTesla
f4b4716fd756e090bc988dc4ca0ad23bdf22a238c3d1b4a329582fb936e8ee92
AgentTesla
+ 19'417 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220209-pc8yysadgp/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0
MD5 hash:
757d71487eb594f05d2fd1d63ac18de3
SHA1 hash:
74562f103361fd83ad22318dba4feccf66ea2a6b
Link:
https://www.unpac.me/results/53e8d23f-5819-4267-a272-83070c322761/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ad6cbb7939f8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe ad6cbb7939f8824d2e2d503673cddd9fd04afe0f17b73565c357cfc9b08098e0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/239512/

Comments