MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821
SHA3-384 hash: 18a8b008496e99ec8b059dcad29646f6c3255a8377d2ba804da0fe43ebde4924dca190dd8ed63c14671ca627548a5ca7
SHA1 hash: 5da09dfc283327b4cb0a32dc0f0a9730a8c923f5
MD5 hash: 66cf0d4e1f5bcba3d37e4a13b8601d92
humanhash: lemon-sixteen-fourteen-leopard
File name:b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821
Download: download sample
Signature AgentTesla
Create hunting rule
File size:582'656 bytes
First seen:2020-11-13 15:29:26 UTC
Last seen:2024-07-24 20:47:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:sbfA4cX8uiW40HcFn8xR9fZbGIY3m+D+t8bMsa2iSo:saX8uiHd8j9xiu+D+F2iZ
Threatray 1'175 similar samples on MalwareBazaar
TLSH 1BC40156C3481F09C9BF637891325E5113F5A969DB62EB463DCCB0FA2BB2B914720B43
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:32:56 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhg33ikozxrx6giugzytbuvoz7kvjbo53wuzq6g6s4bnkoax5aqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0233c43ce1cf759e1d8c8d343b03bfbad84652b12fe32b0e54b7fc7c08bdcc88
AgentTesla
10e5bbc93b83800a83ee06a2652275091670a541f90e1b94f55e8aafacc52a48
AgentTesla
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
AgentTesla
3813d5fe541f008c96f3a0f367113a1fa3c047f08815fcd8335c4b829523ca28
AgentTesla
3a5b1c9c7e10e40551f26dafe302f056f86ce6c6c138a96b0b79389a095b7fca
AgentTesla
3b730885744ae75260212b43010cbd9578df34c88450745169a56a99d2476ffa
AgentTesla
8c3b25751ab09b3f9a6b6f9ce8271c13b5963565c2099077cfc9d30d6ff6abe7
AgentTesla
95eaed904a48a580a9ba80eb8193b178f08b3da26d830b7a8b2fa8f5e3b5186e
AgentTesla
e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e
AgentTesla
f41724b34636a2b2dc0e76328e88be75b5240c7221024f49033fa6fb2648cf16
AgentTesla
+ 1'165 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion spyware
Link:
https://tria.ge/reports/201113-fbbeqk14h2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Maps connected drives based on registry
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821
MD5 hash:
66cf0d4e1f5bcba3d37e4a13b8601d92
SHA1 hash:
5da09dfc283327b4cb0a32dc0f0a9730a8c923f5
Link:
https://www.unpac.me/results/c8d69fc4-ea43-4baa-beb9-76daca7d205b/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/c8d69fc4-ea43-4baa-beb9-76daca7d205b/
SH256 hash:
093554d5727922f236f6b7dba98206156b4b291388a5b2a8a82a3e5f31badf3c
MD5 hash:
2f2ff295ba9fc9eb11674944a2b59eee
SHA1 hash:
27397eb1897f5c8a801985279549dd906ffc99e2
Link:
https://www.unpac.me/results/c8d69fc4-ea43-4baa-beb9-76daca7d205b/
SH256 hash:
252504970be040fbe4c41eea5c827bc592f16e81d637bccb530edd90bd7f73ac
MD5 hash:
87eaf54c5870ba5f7cd66d1021265015
SHA1 hash:
3a5210dac7ca89209d5a58da7fee1714c838e93b
Link:
https://www.unpac.me/results/c8d69fc4-ea43-4baa-beb9-76daca7d205b/
SH256 hash:
30b87633b3e670d5aea5379ad9e480fa84c9c751b9ad8665d81d4ba9464b6a02
MD5 hash:
02e4561687062e569b30ea49f2303f0d
SHA1 hash:
ce629d7ee2146d2821e57cc40ef2aa54108a1211
Link:
https://www.unpac.me/results/c8d69fc4-ea43-4baa-beb9-76daca7d205b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9cdbda14ecde37f1914367130d2aecfd55485dddda99878de9702d53817e821

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments