MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa19f07b5cdf08055f110390e930f284f91222fa4c1341c6b9b9d85b21e30837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa19f07b5cdf08055f110390e930f284f91222fa4c1341c6b9b9d85b21e30837
SHA3-384 hash: 3c5f3bb66e47e53f4782e095b0c2943a91f2f699866e8c11e9f37ab533a7d23a6f419244848039fc5c48c1bb63f11289
SHA1 hash: ecf89f7380551dd5975babbd3586ca16401567fe
MD5 hash: 3845d78c37c06fc0ac0293513ea56442
humanhash: undress-king-venus-low
File name:PO R7084.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'728 bytes
First seen:2021-05-05 14:22:40 UTC
Last seen:2021-05-05 15:17:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:aooLLoS60/K7yh0+viAejIBlbkW26Maea2Tq:aooLAPKhkT6MaX
TLSH 29E46BAC765469F0E35B5D2363CF0C0643651274A93BEA0A8F6013FA5A57F173E3898E
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150684/
Detection(s):
SecuriteInfo.com.Heur.MSILRandomKrypt.3.31597.27737.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fa19f07b5cdf08055f110390e930f284f91222fa4c1341c6b9b9d85b21e30837/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-05 14:23:06 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7im7a62434eakxyraoiosmhsqt4reix2jqjudrvzxhmfwipdba3q._file
Verdict:
unknown
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210505-7ez7m6csa2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
Link:
https://www.unpac.me/results/c74e9a76-ff5a-4cc0-8b66-5313b3b2beb1/
SH256 hash:
c2907d00e66c6361f171c5768975fecbd2e8b4637d7309c2506111f5bd79b302
MD5 hash:
7f314c512624d9db333e15e467667877
SHA1 hash:
60e9b9465fb591eb8d49f933a0714b1328e38616
Link:
https://www.unpac.me/results/c74e9a76-ff5a-4cc0-8b66-5313b3b2beb1/
SH256 hash:
2b595767a6888468d5977c3c94e8ebe51037a756bed5b3f608e3c1c245d4742e
MD5 hash:
eb9f404668036670491b76b63adc531f
SHA1 hash:
4c004c988eecc2e3918e1a160d16720d573aeb19
Link:
https://www.unpac.me/results/c74e9a76-ff5a-4cc0-8b66-5313b3b2beb1/
SH256 hash:
fa19f07b5cdf08055f110390e930f284f91222fa4c1341c6b9b9d85b21e30837
MD5 hash:
3845d78c37c06fc0ac0293513ea56442
SHA1 hash:
ecf89f7380551dd5975babbd3586ca16401567fe
Link:
https://www.unpac.me/results/c74e9a76-ff5a-4cc0-8b66-5313b3b2beb1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa19f07b5cdf08055f110390e930f284f91222fa4c1341c6b9b9d85b21e30837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150684/

Comments