MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afc77f7696c8b66f96691d125433f851f0648e7f4621cc62cea294000043e22a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	afc77f7696c8b66f96691d125433f851f0648e7f4621cc62cea294000043e22a
SHA3-384 hash:	067a50fc7e19a0c6fd605e6169ff42c28bb5c3c22c14d13945366522ecc05d21835d8d9d86986442adc3ed3da38c5a94
SHA1 hash:	c2f7db3a6bd20d8f2d8b1b541fb6ea9b940e0300
MD5 hash:	838c70647938ca047e2e2b9cdf9e7559
humanhash:	undress-emma-paris-kitten
File name:	quote for brass tubing_.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	284'672 bytes
First seen:	2020-08-05 08:39:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	3072:aBKnScR3ZHrFp57czsD12mn2oI89QgyjFAWMIrfHB5w3i+HS1hNYFuglP3ZqzyVz:aBKnSqHB/N22HSlYVP3ZqzyRavJsN
Threatray	10'681 similar samples on MalwareBazaar
TLSH	FE54296C6B48B902F67D193389D2227053F1D5834E12DB0F6FC42EFC6A537CA694A396
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 62.171.146.191
From: VKG Auto Parts ENT <hkhalil@iswebnumerique.com>
Subject: Quote for Brass Tubing Dexter
Attachment: quote for brass tubing_.rar (contains "quote for brass tubing_.exe")

AgentTesla SMTP exfil server:
smtp.office365.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/39235/

Detection(s):

Win.Malware.AgentTesla-7660762-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/410630

Signature

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/afc77f7696c8b66f96691d125433f851f0648e7f4621cc62cea294000043e22a/

Threat name:

ByteCode-MSIL.Spyware.Negasteal

Status:

Malicious

First seen:

2020-08-05 08:41:06 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=v7dx65uwzc3g7ftjdujfim7ykhygjdt7iyq4yywoukkaaacd4iva._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

04137e9b2a7f99a37c6da31b742fed748321ae4a3ff670d97e5181c11ac25c08

AgentTesla

2d1e6b2cf59b6f3cf86892169eb0bdbe685a5c34902919de5b349f0962fa159a

AgentTesla

3b86298f7b9280b5cb9332c52a36c02386cea08e7b3cef8565bd06cbb08f44cb

AgentTesla

4aba472bffc408315c06d8d015ac5241175d6ccfea8c3c04065ba64eccd94cfb

AgentTesla

5964570b4ebb8b449730df21e4e1da41557c306870b7f11b6321ee4dd8e031e7

AgentTesla

6fa3a8b31b5aa450afc06a2a08149af42ef62ae7be55d93db25ec2c3e3edb93f

AgentTesla

76ffbc229ab24de870afa34a18089ed44cd7bae2db361d15213e96618775f318

AgentTesla

aae624caec254144105749a9b12bde61f77415ce28c9f28cc2bfebf0fcbff1f9

AgentTesla

dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f

AgentTesla

+ 10'671 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer family:agenttesla

Link:

https://tria.ge/reports/200805-s9elr1wd4x/

Behaviour

AgentTesla Payload

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/afc77f7696c8b66f96691d125433f851f0648e7f4621cc62cea294000043e22a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar