MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c552c461cc4933aa74cfc448840338efc4f128f2c2c7f4b0363448965b470cb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c552c461cc4933aa74cfc448840338efc4f128f2c2c7f4b0363448965b470cb8
SHA3-384 hash: 010582d8a2f33715139c1a1e9fa12fb5a3778f3506a6711bfb3b62143cf8c2357292ddd9c2aef6ff8d7eddca332e1280
SHA1 hash: cf41c1087c77165682d08baeb068e15347730670
MD5 hash: 306cfb2750134f1b2b8c943277aab883
humanhash: cup-island-pennsylvania-lactose
File name:Copia de pago.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:627'712 bytes
First seen:2021-05-10 17:19:15 UTC
Last seen:2021-05-10 19:07:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:NePVu1Q3HwWNEF0SmeA8MKoLALOL+XmwGGqBz1x:gNuS3Hw9F0HwMKoMLOL++r
Threatray 37 similar samples on MalwareBazaar
TLSH FBD4E1213398ABA0F57EA77D8072210097F5F41BD339DA8DFE9940DD7862F418A52B63
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/154263/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/779183
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Contains functionality to register a low level keyboard hook
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c552c461cc4933aa74cfc448840338efc4f128f2c2c7f4b0363448965b470cb8/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 17:20:25 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yvjmiyomjez2u5gpyreiiazy57cpckhsyld7jmbwgrejmw2hbs4a._file
Verdict:
unknown
Similar samples:
08d9411339dad2fe13ff3f4214d8a8d4a54dd3c9cfc9722c9c57d057826efcff
AgentTesla
1654cb4713d1c70370914a530060eb1345371fc3a85e0be6367ef1e888cb5786
AgentTesla
21bd5e4845c12f0601ae8988314a461339e03e78267cac80f4a34ce93ad404ab
AgentTesla
42b378421943cc08b99ef34c2fa5e118905736064d482fcc63e4f76133965d23
AgentTesla
50a189fe28198ad7f41cfefd5fef208b25ec79be1bdddb540f1c9fef45e4f393
AgentTesla
5e8ad6fd72d00c63a90eb501e353e2b5cb7fe122ad55d71a6d6e0fcf998ef910
AgentTesla
627c7b478ad8a4cd0c9a26333db02a44ac8ca1842d020d527a8a532a78f06808
AgentTesla
775904d1d274498b8a95bc6b06d2a93b9b81a0b79147a29cb06e6a0c418399b7
AgentTesla
d6890849e091421ce29c085e43fea6dc287462acee095269f79b201343929a28
AgentTesla
f8610f6ca225a02d614c976a3de1abb110ea4d6b343e6d06332aacff4640d03c
AgentTesla
+ 27 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210510-96c9yesmt2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c552c461cc4933aa74cfc448840338efc4f128f2c2c7f4b0363448965b470cb8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/154263/

Comments