MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a
SHA3-384 hash: 6d91db7d1819723a7ae0e4313a7c88aef7c5d9fcbc3fe823f8e2488edc178c34c0f726c99fbbe3007dada90cf4505454
SHA1 hash: ef7f24c15fc0b006f6f7c6da3854a94be50490eb
MD5 hash: 455acb29d3223b12d434c016427c1c64
humanhash: music-tennessee-snake-black
File name:455acb29d3223b12d434c016427c1c64.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:75'608 bytes
First seen:2020-10-14 14:46:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:uADHTiKurYTlj0P8y5reMcUphX98UeNbMzDEdyKf/xC88mgm6iiIrlriPriPrPlp:THRuPNp6z/I823UfJ
Threatray 537 similar samples on MalwareBazaar
TLSH 2A73F22521AACF06DDF1477C87C7C9C7D1F02AABB532E2546FCAACC6B4721091B9AD41
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.visiontel.co:587

AgentTesla SMTP exfil email address:
bamaganga1@gmail.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70814/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Sending a UDP request
DNS request
Adding an access-denied ACE
Unauthorized injection to a recently created process
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Sending a TCP request to an infection source
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/491102
Signature
Connects to a pastebin service (likely for C&C)
Contains functionality to hide a thread from the debugger
Hides threads from debuggers
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 05:51:28 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yh5erqfzzakudxbluoo3h7a4iehwempi36nknhacxxi4qve3iu5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
46df88abb8b7f783add8e2688ed3fc2632020fc30f6a87172264a4f434af2524
AgentTesla
493ba8398eed500e3af5e0ae2ea45fa5bfdfbc6371bf67a17ee20c050c117927
AgentTesla
6564b76eec49b15e7a3f42b48fedca593b48e5f145863dd16ea519b3bcf09e60
AgentTesla
757d376a5edc5d260ab3fb209797dbbdf3ce43f6331432174b1398f14e723e20
AgentTesla
8e401cc1c138603fe09da9c9728bf91c7fe2c1f935eec17c940ee5ecde4b08bc
AgentTesla
98f16bf7fd0d32ebf300230c3992712556f0bebc91678c4a6da74f7a900be68b
AgentTesla
b2027562cdbec2beeb72eb09715b7615a62c0050d663eafc82de9d3461a05dc0
AgentTesla
bd5f6e5567639e5e1c4619a02ff2db2eb3242cd6e25e50f7b7559202fc7f061c
AgentTesla
f4468ef3eb4ae6445b097b0200d918ae0e1bba94b8c4c613031e2aab32c9f083
AgentTesla
ffbc4a39ad58fc82025ec9dd1abcba049dc7c66a1ccb8b71fe2171e65f41b526
AgentTesla
+ 527 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201014-mq5al52y9e/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a
MD5 hash:
455acb29d3223b12d434c016427c1c64
SHA1 hash:
ef7f24c15fc0b006f6f7c6da3854a94be50490eb
Link:
https://www.unpac.me/results/a455d74c-0683-4af6-a100-e42d0a2f0e00/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/70814/
  
URLhaus
https://urlhaus.abuse.ch/url/690794/
  
Delivery method
Distributed via web download

Comments