MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ca7eebfdd882ee2f0c0fa96965ade9378129afcef2302faac6391b9fba82debc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | ca7eebfdd882ee2f0c0fa96965ade9378129afcef2302faac6391b9fba82debc |
|---|---|
| SHA3-384 hash: | 57296f06191b086b809af7096efd39a5f4abfad64142b831c7f87c434951055a276ec3a805d8e75991818929bd3710a6 |
| SHA1 hash: | 57415531730d976ea7e5435b28e2e88d88978cd7 |
| MD5 hash: | cf91fa4d002f40ba5d6fbac03a652daf |
| humanhash: | echo-stream-missouri-carolina |
| File name: | PR24869408-V2.PDF.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 944'128 bytes |
| First seen: | 2020-11-26 07:16:18 UTC |
| Last seen: | 2020-11-26 08:42:47 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 12288:mNZYbqsMpUF+wONFi4Hd8Novr3huuR3kuGOF0PytSI5zPvEV9KBPArFH9vxGV2rO:MsMpWmNPWNovdp37aDI5LvEL |
| Threatray | 1'517 similar samples on MalwareBazaar |
| TLSH | 79155B5B3348B3DECA5AEDF1D9201C7ABA50A922431FE21BCDD35C9A9E0D456CE341E1 |
| Reporter |  cocaman |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-11-26 07:17:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 1'507 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
63f359ed543325abc395085ad59c2f66b169360739d2d2cb10e8e9a613582f1d
MD5 hash:
6bf8dcd7d84ea58797126fb94a1f2bf7
SHA1 hash:
1af65c20bb42bb8150d46fbb1347f56ecae0b041
SH256 hash:
44972f1292cead4a36b6e9b63599eaab38c43e7c515dacebcfee86684eaf3f81
MD5 hash:
2cca1dba8f010aa5987751b598288222
SHA1 hash:
8f13a04f39c45b182b7d7f4ce3d785b61143348f
SH256 hash:
ca7eebfdd882ee2f0c0fa96965ade9378129afcef2302faac6391b9fba82debc
MD5 hash:
cf91fa4d002f40ba5d6fbac03a652daf
SHA1 hash:
57415531730d976ea7e5435b28e2e88d88978cd7
SH256 hash:
8aead87caaac644e05b3883dd462a1c8a185b88e6f8df70a49366179c58af7f2
MD5 hash:
00afbfa1e37bd5e4458d336db5158477
SHA1 hash:
a6671d7726430173e671edb5014add8e501661c8
SH256 hash:
a3a008b87ded765ed76c9bedd06dbae5f62edd573da15d376cb3fb91b4bd7f09
MD5 hash:
5ae25f51e2881f74cc9e057ef48c02a6
SHA1 hash:
a8e9e48e0e788e76ce01e923946bfb0c2098b39c
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_AgentTesla_20200929 |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.