MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d597ab712121a3e89fbb752081e14e81a45d1496d8f946fb11bbedfc619c9f09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d597ab712121a3e89fbb752081e14e81a45d1496d8f946fb11bbedfc619c9f09
SHA3-384 hash: 43de7b9ec8c294c1d2f367f9b9cea3721f715abed52f8b56fa75710ef66116be12a819b79f9e1e160b07e805bc104856
SHA1 hash: 7ab9ed963e4038f54f370e2f3bfa13a6eda7c0d9
MD5 hash: 2b8d0d296e15376dfb4c426eb551b6fd
humanhash: stairway-thirteen-uniform-spaghetti
File name:ORDER 150620.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'394'688 bytes
First seen:2020-06-15 05:41:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:5AHnh+eWsN3skA4RV1Hom2KXMmHaDrDGh+dHR22CgrEazjnHMfm7Y5:Ah+ZkldoPK8YaDrDy+xRf+4THTS
Threatray 11'108 similar samples on MalwareBazaar
TLSH 3B55CE0273D1C036FFABA2739B6AF64156BD78254133852F13981DB9BD701B2262E763
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10261/
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:43:04 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wl2w4jbegr6rh53ouqidykoqgsf2few3d4un6yrxpw7yym4t4eq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0262d3c3b2b03ad33d112361a02cc54ae49aab91042075c2978f14cb2aec0093
AgentTesla
23fdb980882367630cc6aa6cb2bb6f49291b171bbaae699935b21b41e388a3d3
AgentTesla
273f5d13f0e0693dd5efebb10076327a729f66f8cf0e07fd83358ebf0b9a933d
AgentTesla
57a9d9eaf24703a6e41397e0627e56249b5e9ac3f13db34978cfdcfcadbd039a
AgentTesla
6b0f2c8d4a8c8883be658db9868b33db30eb73755e4688279c29599eb25c6099
AgentTesla
6b6a9fba247d1842b5d8916951be49963252619ded8f13c4c1003f31cc696e46
AgentTesla
8e68544d2ff367b70b46f00e4136cde9f815823c26877d733da2dba46079a2f9
AgentTesla
b82d04c79bfd870dd7024db85a5c3c60827776af6bfd6b73306ceebf72150ba4
AgentTesla
de2cdf22390a5a5b908d6f910e302cd337f064130065513ba97c1afe1b2f8003
AgentTesla
e59cd07929dcd890599b9ef376fb022a9b0408cd3547a6ebcbffca87932dd631
AgentTesla
+ 11'098 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-evjgmbnrxn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c5ea9aa45581f12f18aff76c62c526482edab29b1adec8bdc2eb5c74ced1bda0

AgentTesla

Executable exe d597ab712121a3e89fbb752081e14e81a45d1496d8f946fb11bbedfc619c9f09

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 c5ea9aa45581f12f18aff76c62c526482edab29b1adec8bdc2eb5c74ced1bda0
Cape
Cape
https://www.capesandbox.com/analysis/10261/

Comments