MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a
SHA3-384 hash:	a60b92d76e346bf8c12a5889eb50894bc18797314cf8a6dbab28a6db45a32e0a6016538b126f5c6801787d566e2f634f
SHA1 hash:	89ae3f2e6720a60319c605afa22dd8e2c01739cd
MD5 hash:	cd483a048e27faf6839f137d37567296
humanhash:	potato-red-lamp-skylark
File name:	Scan docs.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	712'192 bytes
First seen:	2021-05-27 05:32:46 UTC
Last seen:	2021-05-28 08:13:54 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	12288:jWpysdhwb8i8v8B5FqYwPJa/+6/n4UkR+IuY:6ndh9EB5FzMT6/4DwIuY
Threatray	5'355 similar samples on MalwareBazaar
TLSH	0BE47D1C2568D226E5ACD2B48ED5D82FD160E93B7112FFE8D8E643B90B07A43798117F
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Scan docs.exe

Verdict:

Malicious activity

Analysis date:

2021-05-27 05:43:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ed21df9e-23e2-40b4-869c-f35b6cacce89

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/162622/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.46367075.32091.26377.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/793018

Signature

.NET source code contains very large strings

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AgentTesla

Yara detected AntiVM3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-05-26 23:15:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jlywa3urenfqx5erfdunpwaww6glcnv3kchtnbdy35z2zpk5qva._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

27645f1d148b659a43b23aff406fd0a354c0f4c5ad89eadc475cc5b58244c83b

AgentTesla

2bc56dd47a78f4275986e243fb30e12b6b17b06ac420d0464b2bdc0b4b27ebbe

AgentTesla

3f2ce17fe342c19e6ac9890f379841df3c448099e6565b9906538b463fc02932

AgentTesla

7299f2323910def53bb344e98441a66dba82b84b0d8ec89dbddf0ee6a936280a

AgentTesla

8e185bd58ad5131fdbe60c267f00b1e661d39eefe850543fb56243662dbac318

AgentTesla

92bc56e98e19d4d9fbabf683531fa6d25c194723c9a029a46d1a4e87ffaf29ee

AgentTesla

a14532851a6cf9501f2a4f5b0ecc61d4ef8e10d220a401b220cd06ae8f83aeee

AgentTesla

aadf4a2325f03bbc80d38bc0c033e5ecc945a9b132570533f5a3fc41a6e034d6

AgentTesla

f9989bce3ddcc0eb0f95bae744a31bd28e06b229f2757ad7fe7a92c8952ac78f

AgentTesla

+ 5'345 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210527-qxpvz4naa2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d2578b0374891a585fa4894746bec0b5bc6589b5da8479b423c6fb9d65eaec2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.