MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e
SHA3-384 hash: b9d0beb8fef31825003aa54a0ae7717560e8eb7e5f85bc8f5c1157228d071bb9b6162d13f54c7d3d4422a6ab80179fe9
SHA1 hash: e022434eb40318322b17d79cb236c56632d15a0f
MD5 hash: d2ba972357d0417f8e52740be4c9452c
humanhash: winner-don-seventeen-oscar
File name:d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e
Download: download sample
Signature AgentTesla
Create hunting rule
File size:798'208 bytes
First seen:2020-11-11 11:08:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'634 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:znuR/HyxRzZ1nTBSlirIVxi3p5l69ZmHImWft6v0AHQkhO6/cFH:+HkbnyirIPiP8+HImOtw5wkcFH
Threatray 1'295 similar samples on MalwareBazaar
TLSH 30058E032DDA8BE8F18B3336D59A844C0BB4E92119E5D72BECF731960D21393A517DE6
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:10:32 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mjbabb6zsgvzsdhem536fqxhvfgfwisgq65h6vm7v7bzvbm7wpa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
061e4c2aaf9eb384ce88acacafa133185ede67c01c1ad01d1949218e04901c6b
AgentTesla
20dbea65f9ea5d713ead877a8fdca2bb606af820520ea99fafcef39fc7652ce2
AgentTesla
474453d6854784248699500221c30a6fb1a755e0a48308e567ea814481387f04
AgentTesla
62875bbcc1ccebc66490cf8aa7781b959500dec28eee481312a1da08872eb465
AgentTesla
642dfced9844802f4388b3c2f30e08d9a1c94f2507e7277d900756b284d37ca1
AgentTesla
a9f85809eedc7a4033fa134ae35c2b9ab4de23ee6b2bd923662656d531d3236e
AgentTesla
cb90611100b4768af8360f3866d0fd280e232c47ec1093105ad5d1f41731bf94
AgentTesla
d344dbd1534297c5a51142faeb7911acd917232e2e52e61025986ced998c8aa1
AgentTesla
e3a10025b0133fbeb2e454ae7dfec1a6f0e49fee612f7139387f9396434762c6
AgentTesla
+ 1'285 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201111-h1gq4r6by2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
d31210043ecc8d5cc867233bbf16173d4a62d912343dd3faacfd7e1cd42cfd9e
MD5 hash:
d2ba972357d0417f8e52740be4c9452c
SHA1 hash:
e022434eb40318322b17d79cb236c56632d15a0f
Link:
https://www.unpac.me/results/c2b6cb24-f766-4b34-ba4f-0af064519d74/
SH256 hash:
da2e4444ae414abfbe98d6142e4ec7403222bdf359241bc23c58cb6bb1eadb38
MD5 hash:
af15e746d202a05f8464dde8a9c333d4
SHA1 hash:
193c2bfe99d1982f5c0905e5826e384c90361565
Link:
https://www.unpac.me/results/c2b6cb24-f766-4b34-ba4f-0af064519d74/
SH256 hash:
b55a23f5ea2bc862e7cfed670c9b8a97106f10af1967f68b283b7d00b370f130
MD5 hash:
7ad2507abca5017f469c1a2cd06ea92a
SHA1 hash:
3305f346eadb7800df0dd054e2e5a3a560859658
Link:
https://www.unpac.me/results/c2b6cb24-f766-4b34-ba4f-0af064519d74/
SH256 hash:
5ea53085c74f0a1d6c408be9d297dc939b2f73d5caa22e32ba14aa02ee169fd9
MD5 hash:
9b2df9faa17d5101e57fe33162dba8f4
SHA1 hash:
499af353e2c47cd6253c0da4ffaaff38dda3c184
Link:
https://www.unpac.me/results/c2b6cb24-f766-4b34-ba4f-0af064519d74/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/c2b6cb24-f766-4b34-ba4f-0af064519d74/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments