MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418
SHA3-384 hash:	f8a7da51caca8b3ce5a56c1ef07ad14639cbae13dfec1b9b992242b6b2f59d5a4681f77ac120671e06d3f22f09dff8f7
SHA1 hash:	4f6f1759063e93f310501b251b0f9a23ef0653a6
MD5 hash:	f05bdd44e567b5983caf2727f5b3ffa0
humanhash:	three-zebra-tango-aspen
File name:	RFQ-272021.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	637'440 bytes
First seen:	2020-11-26 07:06:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:gb4JO3oL2iNNjEKxth+mMJE/UOeVFOQiT1tHsUH6unGYoaGOouMtnt8LF:gb4JO3oL1jEKxtxMJw16EQqNsKrGYohK
Threatray	10'191 similar samples on MalwareBazaar
TLSH	DAD4027125D2BE96C7BE1FF1D6A221402FB93DAB9A20EA1C7DCC01C91571B59CA01B73
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/547824

Signature

.NET source code contains potential unpacker

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-26 02:56:20 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4eyqprscmfry5ki2pq67jupoy4kt4hvlegfrb7icpxnq6uvzkqma._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2afd51643d6941bd1cb12c0a3b998315bb72d2fd0b1f8f0ca557007e090e87b0

AgentTesla

40fe69be55041a8607bf2596d0fa649ab26f6d6bd6973fb955f14f4e8a066b6c

AgentTesla

4415d19e0b69bdccf79c937db6fe491c4875367cc3ad808b233fa606c708c18b

AgentTesla

5f40f0eb593f0202c8bf43fee6520149a951ced26c299bb7cdceb423e7422a27

AgentTesla

6abf5552765851e4db6d8346af1473568c7d1497fd848648e32bd1c5c8d8cb2f

AgentTesla

ae6c488302c04f00a60835db6b955fb8e1eb42f0e73e71873f5b7dc630596755

AgentTesla

bacbd1e1b139791f7ca8eeba6a14cf7b34c9c010aca5ce7eb527aea212448868

AgentTesla

d346086418bbd48dabcfb8ea48bad551ec66d79c3c0a2e198cd3a1083a80057f

AgentTesla

f148b6ad99c39c47a48a82fc4959b98ccfed28b35556ea3e0f07d0b8911d5e15

AgentTesla

+ 10'181 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201126-fcbvgqsqsx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Unpacked files

SH256 hash:

c864f7e965347a3e92562ed351a55fe8ed8b0f7ab855ed83f9ee1969706c39ce

MD5 hash:

8f58f0d783ed856dbf3c439f87dc84c4

SHA1 hash:

7f5db913fa4a7f4ef9cd686cdea24e386148f6a6

Detections:

win_agent_tesla_w1

Link:

https://www.unpac.me/results/0c302c05-9511-4be9-bc4f-c8f722648213/

Parent samples :

b2a4c9e1fbafc010c19f17103ed3454b96fd23e047a6a03cb01ecdc9f026709e
1a903efdee44ad5501599ad3e80b61dbe73bf605b683be5c53df78b628c63d85
07724738dcb86f8bbcb08246ffd05e44bca0fd761f28d5a1eada30851871cc31
cfb435bdd8d3e8b95c5c6ca82fd51b7f4369746ca664ff6d660d0715b58f07da
632b11a6a0e78b8a04e6588f3809a0077a2de039dcf9745e2816e9ff12b1adf2
e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418
423564a7b9dbcb8a5b81a2b2332287287e359725efe04afa2dc7e43755c0799b

SH256 hash:

29ec667c35ea73466b2c57b11e3806d1fab4d536be41b77113a4e9c9f875d4f5

MD5 hash:

cedfdb3d99f32d659414d0ec86483491

SHA1 hash:

84213994388ecdc5fad7440dacff3793e082e490

Link:

https://www.unpac.me/results/0c302c05-9511-4be9-bc4f-c8f722648213/

SH256 hash:

cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e

MD5 hash:

8cd5d2014866f4ef60802ff1826998a6

SHA1 hash:

8ff75946905d0b117080cc5a07e6e0bbea4e9bbd

Link:

https://www.unpac.me/results/0c302c05-9511-4be9-bc4f-c8f722648213/

SH256 hash:

e13107c64261638ea91a7c3df4d1eec7153e1eab218b10fd027ddb0f52b95418

MD5 hash:

f05bdd44e567b5983caf2727f5b3ffa0

SHA1 hash:

4f6f1759063e93f310501b251b0f9a23ef0653a6

Link:

https://www.unpac.me/results/0c302c05-9511-4be9-bc4f-c8f722648213/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_extracted_bin Create hunting rule
Author:	James_inthe_box
Description:	AgentTesla extracted

Rule name:	AgentTesla_mod_tough_bin Create hunting rule
Author:	James_inthe_box
Reference:	https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	agent_tesla_2019 Create hunting rule
Author:	jeFF0Falltrades

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar