MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4
SHA3-384 hash: 68ad43493a74ddb3b2a532180fe00f35c00e5eeb9432a27c5fe8a0ba59798550022f842b84a5b15fefa4d2bfb143e203
SHA1 hash: 951a923e2f6b3b1efabaf3979cbf2bf043d6c15c
MD5 hash: e1d0f59511cae6d4aa8c6077d01b94ac
humanhash: oxygen-lithium-juliet-princess
File name:Rechnung.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:787'968 bytes
First seen:2020-11-09 18:55:28 UTC
Last seen:2020-11-15 23:10:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:p/zEzIosYKDYKsrquWtP03nQwMr1HIdwiW:p/zEEosYKDBsrzWp0XXMr1odw
Threatray 1'034 similar samples on MalwareBazaar
TLSH 49F4F10423CC4725C6FF5BBAA87010C687F5F782E1FDDBAE9444E5EA08927416A613B7
Reporter FORMALITYDE
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.bc.331.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/526999
Signature
Found malware configuration
Installs a global keyboard hook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: RegAsm connects to smtp port
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 18:59:44 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=66a4qrlfzat5wehkztmt6admy57qgkjom3f3gcjsaoer5sdepxca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
22e520ab895f1f3a545e71a6dc88108023f7e5dee391ef71904f1ec9b1b22871
AgentTesla
2358ed95f04bcb2b05cacf8168d2da545c095b2da8163525102824c668d3e643
AgentTesla
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
AgentTesla
2d5c8fa975518fd2ce9dbe0ea412b4b2e20f56706bfac1bb58cb527d6b60af14
AgentTesla
3813d5fe541f008c96f3a0f367113a1fa3c047f08815fcd8335c4b829523ca28
AgentTesla
63adb2924e560b5372169c820684773bba83fe0ab3e0b51ecf3192b0cda9d774
AgentTesla
93e446bad2646dd1b68653f37e104dc7cd086f948e9b374c5cd97a158d93bca0
AgentTesla
9e2415c2fe10d7f399ac6d36ac217975316345924c3ea9a2a16a7527724e282f
AgentTesla
aeed73db1f8a4bff2294235f9175e96d38f2890cd8a477fc9d33f744d997a240
AgentTesla
f1eda024214adb75fe2aa99abd7b2c8e8cecce443d80a0305a916bb8e03a2bf8
AgentTesla
+ 1'024 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-7wqtmtnvmx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments