MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333
SHA3-384 hash: 021263950ba63529ee5c7d765a8e00eac8d9a7396f5464a3e47dc2753b2b83ac42c07307759d4a4f04c4713c5e941633
SHA1 hash: 8a779daad05afe9e0b1d227b6bb9f042e3c1c7f0
MD5 hash: 85072554c26c2d58bdaab6ffb3a3d732
humanhash: four-lithium-delta-harry
File name:RFQ_202100001009692710218871_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:984'064 bytes
First seen:2021-05-11 05:59:54 UTC
Last seen:2021-05-11 12:17:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:oHiguoI1opjvE3Y6ql618MYc680bnUXGk4GYs:EiXOpTHll6969r8PJYs
Threatray 1'622 similar samples on MalwareBazaar
TLSH EB25231326D9A368C1FE87F890117D0383F5A54A6612FF6E7E44606CCAA77C28745BE3
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/154755/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Connection attempt
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/779015
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=22w4l7kokc3koxa5dyvns3bhtqvmgfds5sr4ams2434dquseamzq._file
Verdict:
unknown
Similar samples:
03dfe6cedcfce8418e60ff61cd7a730c9ec52c383b2e5ccad5c67d0b1168146d
AgentTesla
12c0aac78e35536d75940c301e62cb8cb0388f4e43cf9f1925e02a66cbe2a319
AgentTesla
1b7544a23889922c4262251462e81dc2c6d481f1b6c5164a82e4ea5b2b31ff91
AgentTesla
32672928863af3e154d0e2cc454c5fd31f217a3bfabc7acff2223bb72a5bbe6f
AgentTesla
33a1631c7b9063a39f15b2fde90f874f5657417d7a265fa03b6277b9c907ca33
AgentTesla
5553a7b6943f4c1435ec14ecb41b95029d6f2a94f7f415f660c14bd8b68ab7f9
AgentTesla
6a5e6d882ca54d4bba185f1b881b14795e8148dabeadbaf0f2035fcb2f678160
AgentTesla
a2bd87a81b3cc4f40cc8f1e6ba1111a010ad3970b4dff9e98c729142af28b823
AgentTesla
d00608bb50125705c3e214e84ee2979cb7b982bc6e3ea64c0eed1ae9ad2baa87
AgentTesla
ff05b5ddbc9d78b2f4507e9e2a16d63cc007584d9cc5e641b41a4a73d96d0c02
AgentTesla
+ 1'612 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210511-n7zdl3d9tj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.68
Link:
https://yomi.yoroi.company/submissions/d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fe511d0608ee212469497b1a46574dae0e5fce5b8cb896a7e89fd75f64e30c84

AgentTesla

Executable exe d6adc5fd4e50b6a75c1d1e2ad96c279c2ac31472eca3c0325ae6f83852440333

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 fe511d0608ee212469497b1a46574dae0e5fce5b8cb896a7e89fd75f64e30c84
Cape
Cape
https://www.capesandbox.com/analysis/154755/

Comments