MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caf75f7fb5dd554c31a6b2ef46e3899b3803dcbf65a52919eb4799697692a4a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: caf75f7fb5dd554c31a6b2ef46e3899b3803dcbf65a52919eb4799697692a4a0
SHA3-384 hash: 3f62963a2eae22fd0b9503675f832498d933c29c0ac5529381762da5d2e5e1d94726a1d620736a2ad7d854fde4b00fa7
SHA1 hash: fc2913cd0207d9ac92093cc88cca70480adf4d14
MD5 hash: 3f9752685d701842e1cd47e9757d74c1
humanhash: juliet-louisiana-oscar-romeo
File name:SecuriteInfo.com.Scr.Malcodegdn30.23718.16147
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'015'808 bytes
First seen:2021-05-24 13:06:07 UTC
Last seen:2021-05-24 14:03:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:wBCAy+Va44Tb5wn5WT3dTJ9UrahR/8BNa8Xr:wBCAyjSIRTvUra8BNb7
Threatray 1'072 similar samples on MalwareBazaar
TLSH F425AE2C516EF226C1ADC2794AC4803BE590D7373132FE25ECD757A95728E81BD8227E
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Scr.Malcodegdn30.23718.16147
Verdict:
Suspicious activity
Analysis date:
2021-05-24 13:16:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fa5868a7-ef98-4bea-b9a2-504807474ae7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/161472/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.23718.16147.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/790369
Signature
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/caf75f7fb5dd554c31a6b2ef46e3899b3803dcbf65a52919eb4799697692a4a0/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 13:06:14 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zl3v675v3vkuymngwlxuny4jtm4ahxf7mwsssgpli6mws5ususqa._file
Verdict:
unknown
Similar samples:
03dfe6cedcfce8418e60ff61cd7a730c9ec52c383b2e5ccad5c67d0b1168146d
AgentTesla
12c0aac78e35536d75940c301e62cb8cb0388f4e43cf9f1925e02a66cbe2a319
AgentTesla
1b7544a23889922c4262251462e81dc2c6d481f1b6c5164a82e4ea5b2b31ff91
AgentTesla
32672928863af3e154d0e2cc454c5fd31f217a3bfabc7acff2223bb72a5bbe6f
AgentTesla
33a1631c7b9063a39f15b2fde90f874f5657417d7a265fa03b6277b9c907ca33
AgentTesla
5553a7b6943f4c1435ec14ecb41b95029d6f2a94f7f415f660c14bd8b68ab7f9
AgentTesla
94bc59831134405095078442c69093ae2ffad0cb27b2201334ac7f36e53cf61b
AgentTesla
d00608bb50125705c3e214e84ee2979cb7b982bc6e3ea64c0eed1ae9ad2baa87
AgentTesla
ec5ba1a995945f5ad481b6ad728a688e67792e87e83f43fb18666f4e862dd19e
AgentTesla
ff05b5ddbc9d78b2f4507e9e2a16d63cc007584d9cc5e641b41a4a73d96d0c02
AgentTesla
+ 1'062 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210524-j3hfgmhvqn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/caf75f7fb5dd554c31a6b2ef46e3899b3803dcbf65a52919eb4799697692a4a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/161472/

Comments