MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
SHA3-384 hash: 11375edf16cd65f7d77b6c9ad637cdf29211e8f923cbf51a5199ecf9c179594524174dcf78cbbfabb1c734daede2ac13
SHA1 hash: 0af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
MD5 hash: e8dc83a4ed7657d3211077b7f343fc3c
humanhash: happy-sodium-monkey-utah
File name:Fdquqwatjjr.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:219'648 bytes
First seen:2020-12-03 14:31:34 UTC
Last seen:2020-12-03 17:00:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'471 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:jGW32XuumXzok4CeyFZdUCEpBQxm+uITVLmfOfaXSwN1SQYBy3t7rH:j7oQe0TUrPIhAWppRMd7
Threatray 1'650 similar samples on MalwareBazaar
TLSH 112429166719D561CB5F417FC016821831F1D703A72AD28F5AE6D8FA2F812CEF92B8E4
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/106617/
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.2162.520.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/554773
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020/
Threat name:
ByteCode-MSIL.Infostealer.DarkStealer
Create hunting rule
Status:
Malicious
First seen:
2020-11-28 18:33:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yb4rmmsff7ix7wyiwqsbvv5w6wvpdl3bscdbgaitl3zwgh2liaqa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c316b6e9b1bb80efe9a27b513c7c091cd047d5bf437b88db13f8e45a40e89d6
AgentTesla
3fd2c91007c4b1429d70710853232018e8da2528d375af5d64b79901254e52f0
AgentTesla
53199d2d6d3d21f6a1549eb84faa73b98e68c3c0c4ca31889852a10277125e3a
AgentTesla
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
AgentTesla
68bf0a42854ac13fe13a75bb213f51934a3edc0fa7a0732ddb12a68699619474
AgentTesla
68d0f7126ce746301b1b43bb0e65c8809fd5883224d46575b53cc32b3fec570f
AgentTesla
69b3daa0773330e2607a293d7e268f6360c74f1a446a803944a00c8cd5162527
AgentTesla
7da044c42ca2197b24b974350ae45f50ba9573714685c175026ff4a29a57973b
AgentTesla
9df06d72513716fcfd80d3864d47aa896ec146882ee4cd5a30d998fac7ee72cc
AgentTesla
ddaaa650d42caaed5ddd7c307b986cdccfc25bcb84c7a4f29f9fddd26add4135
AgentTesla
+ 1'640 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/201203-vhgrtchpss/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020
MD5 hash:
e8dc83a4ed7657d3211077b7f343fc3c
SHA1 hash:
0af6cb0ca0d55a2ec6626443b5d91f9c0d0c332c
Link:
https://www.unpac.me/results/911cc029-6b02-4091-9f54-a47a75ac10e5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0791632452fd17fdb08b4241ad7b6f5aaf1af6190861301135ef3631f4b4020

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/106617/

Comments