MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7b159209d33644fbf175828dfce46b31db1c74ae69a3183e59a7226c84391dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7b159209d33644fbf175828dfce46b31db1c74ae69a3183e59a7226c84391dc
SHA3-384 hash: 17a12ed783a5a8e6e44073bb04de3c2fdb0eeb91387a46516963310aa65227daf767e2b2575a1330695bb156fd395b87
SHA1 hash: c10ead21ebaec954916540bb553ade3abee39f44
MD5 hash: 701a43149d1e83d1881e8c081bafb2d7
humanhash: oxygen-eighteen-violet-victor
File name:3460389345504b9d386b926c61b18e9f
Download: download sample
Signature AgentTesla
Create hunting rule
File size:891'904 bytes
First seen:2020-11-17 12:03:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:Tffba9aS8XKw8WXXb63Q8CC+MflW7pcn:bfbwaSt/Wnb6g8plW7
Threatray 1'319 similar samples on MalwareBazaar
TLSH 4E1548AD325073EFC867CD76DAA81C64EB9074BA830BD647A05306EC9A4D997DF140F2
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7b159209d33644fbf175828dfce46b31db1c74ae69a3183e59a7226c84391dc/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:06:50 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46yvsie5gnse7pyxlaun7tsgwmo3dr2k42ndda7ftjzcnscdshoa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c316b6e9b1bb80efe9a27b513c7c091cd047d5bf437b88db13f8e45a40e89d6
AgentTesla
2312da2ef323fce368c195347eb7a3e663827ccbffe04ed3977287d3268ff4a9
AgentTesla
2da02cb0f56579332322d544b18a172c8a3ea6f9506bc9e4a014943ebf174c56
AgentTesla
342af886075cca7fdeb8b212c3cfa6721adb1282dd670f0221a7f08cf1946dda
AgentTesla
380d24b4eb045aa88a24c1cb99e3645ba6f5ebb1ee229d61dfb6e2eee7a74bd3
AgentTesla
87ef5ba8bdcbfaee9829e5fd425c328e63edcb4e35481126a6c11b2498f72ddd
AgentTesla
8d10af8f247bb74f1a3d0878785f3afa173c82d4c881f29dd5b60ea6ed5f6b90
AgentTesla
985bab9e10b690bc2c378a3bf510f89746edfda88e33a3a393bda12e6d040fdc
AgentTesla
b8b373ce2f5835b617f904b50e5e594232982967ea1a12b35bd085c83aa057bb
AgentTesla
f47943ba2297aa6fea4e7661631b16164475196dd3dc5fd93cfcdb9aeeb50a60
AgentTesla
+ 1'309 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-gajheqzbma/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Maps connected drives based on registry
Looks up external IP address via web service
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
e7b159209d33644fbf175828dfce46b31db1c74ae69a3183e59a7226c84391dc
MD5 hash:
701a43149d1e83d1881e8c081bafb2d7
SHA1 hash:
c10ead21ebaec954916540bb553ade3abee39f44
Link:
https://www.unpac.me/results/676df5dd-2ce7-49dc-a149-56c5b24c7f0d/
SH256 hash:
c21aa753f10594ee6553f3d32274bfea6fb9b2c80790745a44701968dc1b121c
MD5 hash:
ce0e55d03f21973e82ef97f7540fca26
SHA1 hash:
0714547eeaa4e79caf4f5c91727045a72dc2e819
Link:
https://www.unpac.me/results/676df5dd-2ce7-49dc-a149-56c5b24c7f0d/
SH256 hash:
8c5f5724fbb53cb447f010c814f319cb13de8a14e389cae5dc60ae62190df2ca
MD5 hash:
a296b13c4e4e8d69489b71530d83c81d
SHA1 hash:
235382edb78640bc128f7a5b1367db2a4ae6ead1
Link:
https://www.unpac.me/results/676df5dd-2ce7-49dc-a149-56c5b24c7f0d/
SH256 hash:
c5ba0e8e4af5065123bc71a7bdb33347e2fb416a8cfa4afc5f6b9e3ff47f57d7
MD5 hash:
30d91b96cd25565ed810bfa973202b66
SHA1 hash:
85f96ae5f02a110dcf6eec4e10cb27c29d7d87ca
Link:
https://www.unpac.me/results/676df5dd-2ce7-49dc-a149-56c5b24c7f0d/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/676df5dd-2ce7-49dc-a149-56c5b24c7f0d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments