MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde
SHA3-384 hash: ddfb39415c6bdb727f9dd42253f2d4ad6787b0304736a1879156e4ce2b14203861b4066ae2146820188e1a4e35ee299c
SHA1 hash: becb237103e5595bd47320bcb01e546ebaaa507f
MD5 hash: 9c3893cce42e78d75b8a2a192df70bb5
humanhash: football-minnesota-pluto-butter
File name:Lt8Vk8wbGCb3T2o.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:897'024 bytes
First seen:2022-01-28 19:09:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:9H2lo92LsgV++yQNep3P/JHrHdmtvdwVZjS+HTD2:9QoUL9V++ySep3XJHr9mddKj3HTa
Threatray 14'507 similar samples on MalwareBazaar
TLSH T13A156F7AEE4E3608D126B8F0502BB46402213EA306D78749E6B7FE0D75F650BCD715AE
File icon (PE):PE icon
dhash icon e2ee8a8eb6d8ecf4 (56 x AgentTesla, 39 x RemcosRAT, 38 x GuLoader)
Reporter GovCERT_CH
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
LT8VK8WB.EXE
Verdict:
Malicious activity
Analysis date:
2022-01-28 08:01:45 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d6c5ba8d-c250-4062-ab3a-077ef72560a4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/225379/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
DNS request
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe obfuscated packed reg.exe replace.exe
Link:
https://www.filescan.io/uploads/61f43f8e6a7929f66a20bdea/reports/72a92860-e71e-4201-9a9e-94d8893f6189/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2fd63e9e-7fa3-4aa1-831b-5c85a8321409
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/929898
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-28 10:58:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wie3z7kvofcncgkumkwxuzjser7vb2f4gdtsunyo6y6c3yhxhxpa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
073e537df1a31ebe720a81a20f86f46f4eb24ee911e317a10a9849a3aeb46c0d
AgentTesla
33f77220ec7d828e77b735ce4c0a277c841a8996ca3eb6bdcc5e94594733590d
AgentTesla
3400fb69c6d46a8f3171110b48b7e443a0828b3a45054a63536b3689b5d2bad0
AgentTesla
6d3deba9b84a0196b94370ee9a1201893fcacacc6736638407d0c4b11b7995a2
AgentTesla
774c6df33a9cada5d1283d67a7cea453b91fd44c69ff8ad4588e9deb94cd24c9
AgentTesla
782e217ec684944693a03a56d29675c879b31fb570c5f9956552ba5968295463
AgentTesla
9e33ca4eee3b2499f384dcfd926f97675258157bbdbeaa5c6720abc746c77d2c
AgentTesla
bc8fc1d6e4b1f2d54e06717a136ebd113d7cf50939958bcf85b9556083d5b00f
AgentTesla
+ 14'497 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220128-xvef3abfa3/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
0c61c6eaa04d5a6971b5dea814558e09d379b75652a68c7ab4a32fa887c4add0
MD5 hash:
d2afb233f597191ededfd1b7c5e84ae1
SHA1 hash:
c90261654c1996b672eae451edb38c75d0508380
Link:
https://www.unpac.me/results/6ba87cd5-f329-44c9-901a-d1d35daa50f6/
SH256 hash:
5247926388ed51a1178cb1de85bc5df1443c240ace43d7d9386edf8d7fceec02
MD5 hash:
9a6cb543f17cc6f61c016dbc8a331bc2
SHA1 hash:
62210e9d0f4d5b8101886a336feb3e1ae0eaf824
Link:
https://www.unpac.me/results/6ba87cd5-f329-44c9-901a-d1d35daa50f6/
SH256 hash:
59486f1b0621da0f203e9e5e08808d60e9a1cd56e85010005b1de453712c23c5
MD5 hash:
a07300279b92bbc9f2529596e409536e
SHA1 hash:
4eef716ab407df7068c055fcd9023b7fa957d598
Link:
https://www.unpac.me/results/6ba87cd5-f329-44c9-901a-d1d35daa50f6/
SH256 hash:
b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde
MD5 hash:
9c3893cce42e78d75b8a2a192df70bb5
SHA1 hash:
becb237103e5595bd47320bcb01e546ebaaa507f
Link:
https://www.unpac.me/results/6ba87cd5-f329-44c9-901a-d1d35daa50f6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b209bcfd557144d1195462ad7a6532247f50e8bc30e72a370ef63c2de0f73dde

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/225379/

Comments