MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9000ee2d7188ba9919e82bfe99560573b71f32b1165c740c9530358f630cb2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9000ee2d7188ba9919e82bfe99560573b71f32b1165c740c9530358f630cb2c
SHA3-384 hash: b50cd65bf4327416e5bda890fef1f859752994f7cefb857837b4bb3878e02d56bedb98647d51c8abb9f9be562126cd59
SHA1 hash: 20b2052fcc7c1baacbb1918fe6ca4a23e67fe35c
MD5 hash: 24b5da73ecb57dc78af15ec07a6d7d80
humanhash: six-lima-idaho-timing
File name:SecuriteInfo.com.Trojan.Siggen9.21473.6536.21045
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'013'248 bytes
First seen:2020-03-18 10:04:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d055a4cf715fd302549e4d7de757ec25 (1 x AgentTesla)
ssdeep 12288:qToUkEknbg77lbmW7TrKEuwf03VpIcgHur+BmWVJBSRJtcrkMuerRrKprzrOb2L6:qU+kmVmGvKEuA0LItXBdf8bMue5KpdM5
Threatray 10'632 similar samples on MalwareBazaar
TLSH 8525CF26F2904CBFF1B32A7D9C4B5E5498EA7D512E2898473BE41D0C4F387A13639297
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7641269-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-17 15:27:53 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zeaa5ywxdcf2tem6qk76tflak45xd4zlcfs4oqgjkmbvr5rqzmwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
08b8b5c623bd115853cacfa860262fc966334f844a0bda1ed0dfb64bed0e8504
AgentTesla
160e7aaa4e51fa944fdd6634193b77be5b9f7f9f1b694b9fdfb9ae1d7d5a430c
AgentTesla
4119ad71f4f0b90b51e983fdf38008b853ebdfd0db175704d59fcbbc2adb8cda
AgentTesla
67819aacac4994b55659a8f7924ec0384e667ee74fe5b431a731ac5baf69448c
AgentTesla
7607102eead4fb3d71ed2c2b492eb4828d5c544576102aaa94d29debce0f211d
AgentTesla
9463f129f4dec7224eb12c262e080ffa58c104bde38104319ab69d2fdb8919ee
AgentTesla
b9ec899a1cb59794313ed0db3e338dbc43970785be52cf756b0d33588c0064d8
AgentTesla
d1af0c54eca027eb8089a7a721c88de4cd6e522c5cf3f38919249d2513174d1b
AgentTesla
e651957af4c527f8a23f8c3094232c887e2a433974ab54e48e2519e8361809a6
AgentTesla
eced8139c7651d297e4bc18c9b8783b76ffa477c07e09b269739d8b6fa0d14de
AgentTesla
+ 10'622 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9000ee2d7188ba9919e82bfe99560573b71f32b1165c740c9530358f630cb2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe c9000ee2d7188ba9919e82bfe99560573b71f32b1165c740c9530358f630cb2c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/326257/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments