MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c87a719713c51891fa7b0def4b093441934d9f60ef8bd52951e2efb9a030f59c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c87a719713c51891fa7b0def4b093441934d9f60ef8bd52951e2efb9a030f59c
SHA3-384 hash: 236bd275f7b0d725a897f7f81e503afdd80fd0f8b25ba6b80523dfa8f5da23919186c41af5bd820fef5f3d3611a26296
SHA1 hash: a424e91c83109f5231f319b02c4da0c59b5ad8df
MD5 hash: 35623cebc7a9d8fffed698e628b58d85
humanhash: asparagus-glucose-river-burger
File name:35623cebc7a9d8fffed698e628b58d85.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'422'909 bytes
First seen:2020-05-21 19:20:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 24576:RXhZgPlsrr5YcENm8kO/VlHbBZ60VeKDyzm/ERDqUuLRwGGp+Rw:pICrENmnqVlH/m6Em8c/wj+Rw
Threatray 2'210 similar samples on MalwareBazaar
TLSH B2651241BAD581B2E5321D3756296721A87C3D302E24DE5F77E86E2DEE301C2B625B33
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheRARDropper.19200.30796.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 19:35:47 UTC
File Type:
PE (Exe)
Extracted files:
47
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
remcos
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
0b8d469babc7b057403a1d7ca0f781c9a675523941cfcc8bb6eae582680746c4
AgentTesla
2ddbe8b9f04a4a672878c6b54b8a3440d2f7d89b2fe0c5949df21c997c5443f7
AgentTesla
40838317f53ebe7b37fab29e95826e44ffd7eb7b349e8bed0f5d7ae5db013df1
AgentTesla
4692d4716a224f54c928808d2d7ee7e9eaeb8531f1cd29b91886fa511a12f07a
AgentTesla
59b1b0e770b3b964f7ad3290b9ebfa845b828c7819cf8282b2b7aa89530cff78
AgentTesla
77f25549a1a3f0bc29ca746125f0ad306418ee9699c1b7cd57c36d29488134d2
AgentTesla
a500f27709fb009950d25abae11f25c6e8e0205d15931530467ecfb342a661ad
AgentTesla
a7d93e9c9bb80f0f8a271ae4a101f305bac535e197697b35f291794fa83ef538
AgentTesla
ac120fadb0fde46db30df42a52a0b65d34fa6621fa13f18c11b5fe93626dcf6d
AgentTesla
d461810943d78b803fbc9a0ea85d16325af10764243d7d3d6b7b24d52efe685c
AgentTesla
+ 2'200 additional samples on MalwareBazaar
Result
Malware family:
remcos
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:remcos keylogger persistence rat rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-nven9e54ba/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Modifies service
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Executes dropped EXE
AgentTesla Payload
rezer0
ServiceHost packer
AgentTesla
Remcos
Malware Config
C2 Extraction:
eastsidepapi.myq-see.com:6996
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c87a719713c51891fa7b0def4b093441934d9f60ef8bd52951e2efb9a030f59c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/365270/
  
Delivery method
Distributed via web download

Comments