MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0
SHA3-384 hash: a8017daf6537b51bbaa5c100b2f770ca33c6a0044e42cadf00a7c175620903f0840fd48fb4516269a3ed6c8539b2a233
SHA1 hash: c60548056a22d94ef1e1cb2fe0642ba2986f374a
MD5 hash: b59ce6eaa5619348fb5fe9c92d20e97b
humanhash: violet-green-wisconsin-foxtrot
File name:starmoneyx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:802'304 bytes
First seen:2020-09-28 21:39:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ccd477c88c3e8be26b5e0692515f665c (4 x AgentTesla, 1 x Loki, 1 x Formbook)
ssdeep 12288:338ZC2jTIBwgM9poZThtKyx12lwLxog3rChBQhwIRP1/J9zkQK2oJD89:HfzBw3PotKWR9h3On6t1/LEDm
Threatray 1'783 similar samples on MalwareBazaar
TLSH 33058E36B1A15833C123ED7C9C0B5774AC27BA502A247982EBF5DF785F39691382A193
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/66540/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BackDoor.SpyBotNET.25.22426.17687.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Launching a process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/476836
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-28 13:12:10 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
083e098c7a4893abdbb906f03b92dda1f54c469527f2f59eafca8f1176d2686f
AgentTesla
10afc2fcb1ac4d85ac3076f260e008dccee9f1715fd56d1fa6180d504655275d
AgentTesla
27efe7f981e88e619d7a59df155f8b9f7c7bdcc0f52b08de1c0cedeaa9e817d9
AgentTesla
3ee59149caa2a1f67159eb37aca56d4e1019ea5b33851c5b724a4911c0b0b4d7
AgentTesla
5d988a8c854a4ebca5533e5273c1a797c3900d3fb9cc20bf7186578aff26d825
AgentTesla
63d643f5f17f5e621ef22e4c05a5d92c519376d0043c0958284d34ae206c0161
AgentTesla
68c67f845d8c48aa74901553deb7cc31b7f2a27954d75e4f67093c70f81eb9d6
AgentTesla
7a5cf1b0f0b115b160a48992609c57b8f9c4591a736ffc052549b2f1e91e2eb7
AgentTesla
d5d44e7e31d0ae752539ce070a13f61d68bef86bb29b2f1650b2dfb42e999729
AgentTesla
fb9170b75704e2202310a4ea95652f93cfcc6d4c4700055156ebb8e5532c4a9b
AgentTesla
+ 1'773 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/200928-8qef8qjsjj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Unpacked files
SH256 hash:
c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0
MD5 hash:
b59ce6eaa5619348fb5fe9c92d20e97b
SHA1 hash:
c60548056a22d94ef1e1cb2fe0642ba2986f374a
Link:
https://www.unpac.me/results/4f865b2f-340f-4b2b-8f09-d74024ac57c1/
SH256 hash:
6e5bbc4a1187a67a3ad2d5b5353f8b19cdde10d17c8b519c640f361e3634a582
MD5 hash:
ded1c159279259b4fd66c6228fc737c8
SHA1 hash:
3a10d118df4cd0f6708f6ac7f8f07cda6cd3c589
Link:
https://www.unpac.me/results/4f865b2f-340f-4b2b-8f09-d74024ac57c1/
SH256 hash:
9583c92947789b9c08ddda92c754e6f9c2e1da4cff65501c02594e7a76ac8c70
MD5 hash:
272a5db5069a3720b5bc5b246a3b82ec
SHA1 hash:
b23feaf42fbeb387015ee23ea7e405a966415040
Link:
https://www.unpac.me/results/4f865b2f-340f-4b2b-8f09-d74024ac57c1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c95b9b5cf40c96d46c8a6443c458575ccb0cff8e0f750a3e9506c62a155bcfb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/66540/
  
URLhaus
https://urlhaus.abuse.ch/url/619143/

Comments