MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
SHA3-384 hash: 0c86e61d8b4898d62ea3cfba5f4281006d1d21f21d98e80d14d44db037b13cd20a09a89d7e1b2ef2b10863c2dea90eb1
SHA1 hash: 98daded31fb12dcbc50538351239240e520b3e54
MD5 hash: cb248bf0269fe3e4ce6d669d5bbdcafa
humanhash: mississippi-eight-item-stream
File name:cb248bf0269fe3e4ce6d669d5bbdcafa
Download: download sample
Signature AgentTesla
Create hunting rule
File size:690'688 bytes
First seen:2020-10-25 18:11:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'631 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:Ax9A1GKZHNYPzodDucV7JegswmnnJPs+Vx0ZhrWwKE4t+WBrw2Zivd:ADA1GUKzodDXV7YZbJPs+QZhalEJWBr
TLSH 61E4124061B5AB36E27D8BFA301D802D83F1505D3B62F66C5ED637F956A0B805F28E63
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/76054/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/509901
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687/
Threat name:
ByteCode-MSIL.Trojan.Agentesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 06:49:11 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6au34qr6g7ee6hkfzoes7zfzbkdahbzi3ikye2zhdao3meie2dq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/201025-enare1sadn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
MD5 hash:
cb248bf0269fe3e4ce6d669d5bbdcafa
SHA1 hash:
98daded31fb12dcbc50538351239240e520b3e54
Link:
https://www.unpac.me/results/63637c02-b8b9-4e9b-a500-4e58c1931854/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/63637c02-b8b9-4e9b-a500-4e58c1931854/
SH256 hash:
cc53153fd6b341a1ae3c6c98359036a910d7524407071bce280350105d4abae2
MD5 hash:
e0de7c091c8c60b03d89f068d4d3bbb7
SHA1 hash:
2740bf441986c54b2e877d2fcd7333be4b07e2a0
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/63637c02-b8b9-4e9b-a500-4e58c1931854/
Parent samples :
9029fc110d6ad30af1c140d2c7af2192b17c04986ba7bacebed72d58c84241a7
33a99ba14b9e93cef87a604f7cf417ecec809ab10574a6aef214ca39454144ef
af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687
3ec8f4e2f3725e6f5d28c4f2cbbec5dcca4483e9e3e5fe433628cf6565cdc024
16058a8ef66dc11b4b441151340f7a78cf6112586011e51b63c599c4b25eb4b9
2724536d5c8f56b46361fe1801cec990b885938dc7f1ef031a399065678ceb71
20d2e1c04a90d710aba955231389d8f36bda6c07e10510123204ab6c5b5431ac
SH256 hash:
3ed139ec4ebe59da527b92fed8f85565717754ba2ccbfd6c1a366a21c218021d
MD5 hash:
3ac0693a42f4645f3b24535160fc6d5b
SHA1 hash:
7e98e58f263e34b4502a3d49188110ac29b2405e
Link:
https://www.unpac.me/results/63637c02-b8b9-4e9b-a500-4e58c1931854/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af814df211f1be4278ea2e5c497f25c854301c3946d0ac135938c0edb0882687

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:unixredflags
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for red flags
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/76054/

Comments