MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da84ebc8503de1b6c7d4388b75738b72ae8c2a84746bc34d6ca07266b8917ca0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	da84ebc8503de1b6c7d4388b75738b72ae8c2a84746bc34d6ca07266b8917ca0
SHA3-384 hash:	e2a81f646cce2866603ec2bb27cb61d28153eb0b94a905004c90c7b845f6ea06a541bb1efe17f1247f75d74848bb7ece
SHA1 hash:	ea4807412f01623143103231afb0cb3c87de4a0e
MD5 hash:	d21612c802eab4db6c772f8c8dc1d1df
humanhash:	five-hotel-butter-crazy
File name:	d21612c802eab4db6c772f8c8dc1d1df.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	970'752 bytes
First seen:	2020-09-20 04:00:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a2db9c8d6397be4202b6dff9fc1d53ad (7 x MassLogger, 5 x AgentTesla, 2 x Formbook)
ssdeep	12288:VDb7BqrErn/mxx7E6vMJaxKwWoFJm6y2o/Yc4/P2x1AF3K+LJzK3PbQScFlDVyQg:VFBrny7d7eqq2Z32ym3PB8lDP4
Threatray	9'377 similar samples on MalwareBazaar
TLSH	5225AF23B2A0C837C523257D9C0BDBB8AE2AFE103A18BE466BF5DD485F3954274161D7
Reporter	abuse_ch
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

164

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.Trojan.PWS.Maria.3.15178.30929.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Creating a file in the %temp% subdirectories

Reading critical registry keys

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/470738

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/da84ebc8503de1b6c7d4388b75738b72ae8c2a84746bc34d6ca07266b8917ca0/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2020-09-17 08:26:54 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3kcoxscqhxq3nr6uhcfxk44lokxiykueorv4gtlmubzgnoerpsqa._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803

AgentTesla

65bdf218a95af52100c20e6f146a7acf16aa0ed0a34ddc7f4a68c66554b648da

AgentTesla

84da474dc9a86be051d5a30bd2c4715026e0faab0daf2950fcbebb8e46f907ad

AgentTesla

9b3a4e8995b4abd7596009d4d52e156b2d70600084c006d692e83578df3aee16

AgentTesla

a84cf81fa2d7790ea8f5d59354fa47d2067a12c89c2d975ee2f3b9547765be1e

AgentTesla

a93f51a2685bc2a56a36a482e045ae7d5ae2055e7176b54cee959966c2d06f66

AgentTesla

d2bb06dc3882c72e26ed7598fee37d128955c229246225ed393d90bd2a4eb1dd

AgentTesla

ea2715d63520d67662c664143185e265af50955b830f8b03a5ae147bba9f1335

AgentTesla

f7a21b812eaebf24b601f897d3287979247b6025b1e20841ad8b34ec5d1c6575

AgentTesla

+ 9'367 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

upx keylogger stealer persistence spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200920-whagv1879e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/da84ebc8503de1b6c7d4388b75738b72ae8c2a84746bc34d6ca07266b8917ca0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar