MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f90d8d1f0ce9077a99a382d62da3582c74ebd7a9f2dafb4df91d30f76856da4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f90d8d1f0ce9077a99a382d62da3582c74ebd7a9f2dafb4df91d30f76856da4a
SHA3-384 hash: 4a16b77ff9fb113857153f5351f4f68722f09c237f5f806346427de5b3ea5d8b4b2e49d7627e6ffda9ad5d6e614d50ac
SHA1 hash: cd874d9c6d1e7c68346343e49303827265af3ab4
MD5 hash: a4e5ea173304907b2af5dbebd9c25d7e
humanhash: zebra-mountain-magazine-mississippi
File name:0NvjznyMDU6yygC.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'453'568 bytes
First seen:2021-05-05 11:28:02 UTC
Last seen:2021-05-05 13:21:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:nGT3uAhgsIUoLAWJ20EWlYEA+uafoMfsVSqhyTq7U:nGT3uk0EYY9+uWofxYq7U
Threatray 4'490 similar samples on MalwareBazaar
TLSH 17655FA8715030EED56BC6B69BE83C54EA103876471F410A922333FD9A7EE53DF245A3
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150532/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.AATH.8079.30234.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f90d8d1f0ce9077a99a382d62da3582c74ebd7a9f2dafb4df91d30f76856da4a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 07:21:00 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7egy2hym5edxvgndqllc3i2yfr2oxv5j6lnpwtpzduypo2cw3jfa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
22e520ab895f1f3a545e71a6dc88108023f7e5dee391ef71904f1ec9b1b22871
AgentTesla
606c4f2ce5137a68df332711e8bcc880e4c28c77c6974bac48f2826da93ae049
AgentTesla
7495c08fc81b009e27f348ba86ccec5ca51826e7f7e7fc74342f36a8d84020f9
AgentTesla
7d4291707493bc84921a0832f42340e5377d0e58ce15e43a066ebd03f0c7c413
AgentTesla
9189313c82849b055af58dd07b281ab0f8cd50a9a043524fc0e2b3a02d961405
AgentTesla
93e446bad2646dd1b68653f37e104dc7cd086f948e9b374c5cd97a158d93bca0
AgentTesla
9e2415c2fe10d7f399ac6d36ac217975316345924c3ea9a2a16a7527724e282f
AgentTesla
a2f1773e4b9146563dbf711ca1462448a7a847f8b6660424f72faaa5fa9b20d4
AgentTesla
e939f660ccecb1d207c61756cd835d5051f0a154cb06a4c4edf5029df151f2d5
AgentTesla
f781c84565c827db10eaccd93f006cc77f03292e66cbb3093203891ec8647dc4
AgentTesla
+ 4'480 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210505-vjpynsb86s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/2283d0b5-f397-4c5f-9b0d-0ac9c7ca69ac/
SH256 hash:
465a3a0ff46b376ffcf513663350cbd4dcfa1a087ba2d21a044afc8d483c56e5
MD5 hash:
6266a6f023a1eaacc300ba199f19e918
SHA1 hash:
8f8a82e765ff73911928830dc22bde53fe829a48
Link:
https://www.unpac.me/results/2283d0b5-f397-4c5f-9b0d-0ac9c7ca69ac/
SH256 hash:
7884549d5b588c737dc5be78b064d9f62976ebd583400ac18935a650751c55be
MD5 hash:
8fd227f506138191264403b58e7b908b
SHA1 hash:
3001d5bb6d962b2ad7f26124fb70eaaf97a2ec6e
Link:
https://www.unpac.me/results/2283d0b5-f397-4c5f-9b0d-0ac9c7ca69ac/
SH256 hash:
f90d8d1f0ce9077a99a382d62da3582c74ebd7a9f2dafb4df91d30f76856da4a
MD5 hash:
a4e5ea173304907b2af5dbebd9c25d7e
SHA1 hash:
cd874d9c6d1e7c68346343e49303827265af3ab4
Link:
https://www.unpac.me/results/2283d0b5-f397-4c5f-9b0d-0ac9c7ca69ac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f90d8d1f0ce9077a99a382d62da3582c74ebd7a9f2dafb4df91d30f76856da4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150532/

Comments