MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b39de16dd4f9cca5342dcd36875ceb246874f486698e34fea88e095d8596b368. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b39de16dd4f9cca5342dcd36875ceb246874f486698e34fea88e095d8596b368
SHA3-384 hash: 6ddab712f0eead958e9d42010863e7400d85c81e1107f7e0079512c9e894e9ab96b0cfe30d83375d0322c29e52469587
SHA1 hash: dced03cd0efdcad81f172647f7f7c601de04d40a
MD5 hash: db08dad1b24a01a1c98dae412cab131a
humanhash: undress-winner-fifteen-robert
File name:Scan 979.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:221'696 bytes
First seen:2020-12-07 11:35:26 UTC
Last seen:2020-12-07 13:46:06 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:oyVg/1Uu13b43WRNinhAwlOciBGnliDp:oyVURl43wQnewlOciae
Threatray 1'703 similar samples on MalwareBazaar
TLSH F5242A166714D560CB5F417FC016820831F1D707A72AE6DF5AA6D8FA2F812CEF92B8E4
Reporter Anonymous
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
db08dad1b24a01a1c98dae412cab131a.exe
Verdict:
Malicious activity
Analysis date:
2020-12-07 23:27:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1fa44177-d659-4020-9c04-d1da65613985

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/107012/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.17336.1498.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/556760
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b39de16dd4f9cca5342dcd36875ceb246874f486698e34fea88e095d8596b368/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2020-12-07 06:18:02 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=woo6c3ou7hgkknbnzu3ioxhleruhj5egnghdj7viryev3bmwwnua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
103903b8cda6c1d3d2324c704b7bcf6d1f3b5211dc871d246bbb74595f128009
AgentTesla
5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26
AgentTesla
7a1b25d0bdb7a73494ebb70190155a601a982bd248c5ac8b1fe39666b2cb0565
AgentTesla
7c1011ea932942d42054c1b973cdcf765076fae3e6c8483280580f57ac65a539
AgentTesla
91816d916870f6e48ed8937694ab3108bfd6b57b1aef7a69dff474db7602e274
AgentTesla
9bc94d701cc45f74ee489efe7d99e84017d17a71e0232b0d14cf82c005a1ae1c
AgentTesla
aefa2f5a8448c792183fedf9d025becfb782102b749c0fe3be273975f2dc3b61
AgentTesla
c2492c733ead768e887ed1ebb1d1ee48fe059bde4f4650f5674c7c66adcc0dfa
AgentTesla
d29642be607daa745b16691e95ff38c4da4c0a935caec464cd3beb27afc3cb8f
AgentTesla
de0419f15e231116f87b5ac3a8aeab734175c685920fce69c8c39836d1ab4491
AgentTesla
+ 1'693 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201207-bvtrn8q61j/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
b39de16dd4f9cca5342dcd36875ceb246874f486698e34fea88e095d8596b368
MD5 hash:
db08dad1b24a01a1c98dae412cab131a
SHA1 hash:
dced03cd0efdcad81f172647f7f7c601de04d40a
Link:
https://www.unpac.me/results/6bd9fd29-794d-44a0-a575-7b2e95159943/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b39de16dd4f9cca5342dcd36875ceb246874f486698e34fea88e095d8596b368

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/107012/

Comments