MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8abb9259099fbb46b0d24cb342f32cfd5b3046487d55c8843bc819315da12b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8abb9259099fbb46b0d24cb342f32cfd5b3046487d55c8843bc819315da12b1
SHA3-384 hash: 080d5c8bceaad2ba3a228961cf155762c9e8ec07b6124bf0e9891546c536aa5ddaaef6e6fdb7e64bc0612a8762435ef9
SHA1 hash: e7816a5571c244352f1963fc8eb72766060c53e6
MD5 hash: cc4aedf37371b639cbff41d8c64875d1
humanhash: oven-kansas-magnesium-maine
File name:4ad8d56dd843f7acf7a940940d1ab3a4
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'044'480 bytes
First seen:2020-11-17 12:18:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:4GiyGb71NJGdDnYlv0FJ/Se7EHJb9ucSxmRo2n5py2huN:1NGb5N0dDKvCcucbRo2na2h
Threatray 1'265 similar samples on MalwareBazaar
TLSH FA25D00A2BC40A1BD5AF177AE0341184D378E852E797FB9B69A9A0FC08D33588D457F7
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8abb9259099fbb46b0d24cb342f32cfd5b3046487d55c8843bc819315da12b1/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:23:53 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3cv3sjmqth53i2ynetftilzsz7k3gbdeq7kvzccdxsazgfo2ckyq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2e132b331b416b7480762cd12eda3fba08eeff73f54042c44247419a28450708
AgentTesla
4d110e0d08384339b1bc38fbcad2bab177df0ad27b5f5cb2a3b88e8237052abd
AgentTesla
622b5044ebb502fe18158372f5f5fd40987aec1d0c860e40f6e3a77650ed94a2
AgentTesla
7543d16d9eb66ebcb61a632b705609940389665e09e7e4bdc3ec33f3612d1dcb
AgentTesla
85cdb8ba6c26cda233caea43b4f596e399b4cf7e561ac3c8c6cb4214cddf54a3
AgentTesla
a3230e59a4a3a5f499ff5d3f6a6d595ba1be76befacea3a3770d9980298d4583
AgentTesla
d8d901bb4e3990c3eff141e0030128a484e35ca5145a46e63d43fcfb841a8c32
AgentTesla
db15c1cea9481097cc1b2071902ca0523cde0aff7e96f859cf495a153b552249
AgentTesla
de53b13e9795b9cbdb03534e3b1d7a809a8962147f10ccb10a55f2424735d130
AgentTesla
e4974ddc809773cd725cfc7070ad545ddf4aa1fc211eb77a1eaae7b7fc1a019c
AgentTesla
+ 1'255 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201117-7kyalj4mzj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
d8abb9259099fbb46b0d24cb342f32cfd5b3046487d55c8843bc819315da12b1
MD5 hash:
cc4aedf37371b639cbff41d8c64875d1
SHA1 hash:
e7816a5571c244352f1963fc8eb72766060c53e6
Link:
https://www.unpac.me/results/c15cf898-d2af-4445-93aa-05c448d030e7/
SH256 hash:
fc72e46043450d054c478551bb1422bd80ee99d80bcf4895b33ba862c8e63641
MD5 hash:
95add91c2f1cd3b1fbbd112d8a5de23f
SHA1 hash:
301fdbffba9d9aa2d1770335ad12fa5f4da618a4
Link:
https://www.unpac.me/results/c15cf898-d2af-4445-93aa-05c448d030e7/
SH256 hash:
7a04a0942e98d892b4c21820855d8d38a3f6379273cc741807b985008c1c65d3
MD5 hash:
1e0830c1b14c2eb6e15ae337a6449a8a
SHA1 hash:
7aefce3d5fe24a1391d034381ee25ac40db93c47
Link:
https://www.unpac.me/results/c15cf898-d2af-4445-93aa-05c448d030e7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments