MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd
SHA3-384 hash: 3a2a335a1b46d9192c78be711b83b536b25dcad04d1c5738135295b024f81a9e830e9c829a077d474233a2db846b26a7
SHA1 hash: c8d51c9b0175a44555ca755156c0fe34dc693a2e
MD5 hash: fb47aafb960e4b536add3f77051627e3
humanhash: network-orange-crazy-nine
File name:APLUSHPH-DKK, 3X20'DC, ETD 23 oct.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:911'872 bytes
First seen:2020-10-19 09:33:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:bQk6CNWEv2ORwyT+MM/dZY9R5gYA1GUKzodUo/:bJ1M/KsYANKzoF/
Threatray 636 similar samples on MalwareBazaar
TLSH 3E156A0532F84B19F0BA97F5573440849BBABA5A153ED25CBD8E31DE1FB2B024A43B17
Reporter FORMALITYDE
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72822/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a file
Creating a window
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/495134
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 300021 Sample: APLUSHPH-DKK, 3X20'DC, ETD ... Startdate: 19/10/2020 Architecture: WINDOWS Score: 100 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected AgentTesla 2->28 30 4 other signatures 2->30 6 APLUSHPH-DKK, 3X20'DC, ETD 23 oct.exe 3 2->6         started        process3 file4 16 APLUSHPH-DKK, 3X20... ETD 23 oct.exe.log, ASCII 6->16 dropped 32 Writes to foreign memory regions 6->32 34 Allocates memory in foreign processes 6->34 36 Injects a PE file into a foreign processes 6->36 10 RegSvcs.exe 4 6->10         started        14 RegSvcs.exe 6->14         started        signatures5 process6 dnsIp7 18 teleflo.co.in 192.185.75.4, 49752, 587 UNIFIEDLAYER-AS-1US United States 10->18 20 mail.teleflo.co.in 10->20 22 192.168.2.1 unknown unknown 10->22 38 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 10->38 40 Tries to steal Mail credentials (via file access) 10->40 42 Tries to harvest and steal ftp login credentials 10->42 50 2 other signatures 10->50 44 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->46 48 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 14->48 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 09:35:05 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3kjfhsd7krz2izcv3gopso6g2h36moyuubkn5jhmoa6megotp6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3b97909b8cc676b840fd25680d29f211efcc6c71a0234f33365dd0fec17e8438
AgentTesla
58bd9279e5ef2a3c1a55c9257c276f8203b69c79e29008399c6629eaf8ca6d56
AgentTesla
6490275833a54ddb21377ef003cacd595697c7659c1b7c6fc24a285fec1946ee
AgentTesla
680e6e46c8bed6c48e63f6dab3409bb9cd05f6642084ef8b0d03898dacc500a7
AgentTesla
99cc56c49ea22eaf929c14180a5625096c6652ae122fb35d913ae774604965f0
AgentTesla
a6f68b61781c4503ac6dbc6b79d22d3a2f6e7995c35e85f08c0d153e056d6f0e
AgentTesla
b8e4dfdddae3c40ef710797605631573fe5689ae296637a411a88f8f3c1d7389
AgentTesla
ba5cf0e14767afbaf1ef4310a5a7a55e152b7c54507a1b567133cdf42493629d
AgentTesla
d18f27370f8ee9d89c588980241ef2757a4a5d6cc70a357c7a45fae186c7e84b
AgentTesla
eacd132f69b64ef7a47c959fd92f50343be23e5768f0476c665870f5de4f89ee
AgentTesla
+ 626 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201019-7h42qhjwyj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
9185ee9852becdb25e5ee32cce6d2ae8bcf5656efbdde701428f883e92bcf8d3
MD5 hash:
2233dcf0a771769f2b336212b625c5a6
SHA1 hash:
1656c4b0d2254665eaeeaf07a87eb2c079dd00b5
Link:
https://www.unpac.me/results/4ca223c4-1086-4521-ba46-ad59b60da444/
SH256 hash:
c18a043c7b138a7fa16af3d4e3511d1d8e14d6cb63f42372e08d9f85f8f8ac61
MD5 hash:
0f0ebbdc318b835ea2ee774edafa7f91
SHA1 hash:
9d880188bb90d868dab0e85b2e80b49365c05272
Link:
https://www.unpac.me/results/4ca223c4-1086-4521-ba46-ad59b60da444/
SH256 hash:
8a2decd236f8a20bb72436dcfb608a94828adedbe6f57ef76418b62953fc3da9
MD5 hash:
9c25dfb42275cf7eec7c5450df6e9c17
SHA1 hash:
e81db8b52e37c626e81bd5ef26a1028a47a836b4
Link:
https://www.unpac.me/results/4ca223c4-1086-4521-ba46-ad59b60da444/
SH256 hash:
c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd
MD5 hash:
fb47aafb960e4b536add3f77051627e3
SHA1 hash:
c8d51c9b0175a44555ca755156c0fe34dc693a2e
Link:
https://www.unpac.me/results/4ca223c4-1086-4521-ba46-ad59b60da444/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c6d4929e43faa39d2322aecce7c9de368fbf31d8a502a6f5276381e610ce9bfd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72822/

Comments