MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd5cd7dfa99788f1a9e7f8bcf9de43b2577bb43623eae2c53b4b676010e93088. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd5cd7dfa99788f1a9e7f8bcf9de43b2577bb43623eae2c53b4b676010e93088
SHA3-384 hash: ae9e12f007c71f814a902760490c4d4b2a4ae1484458fc6b7bbf7dfe553f225d6fb2f9ccc174b0a3c8ac18dc0b8e976e
SHA1 hash: 2f8353c9af8d330f6fdff777a190e96cb4439d21
MD5 hash: ddea57a8737c52435353b937ec9d9569
humanhash: video-tennis-equal-early
File name:Quotation Required Details 8929303030.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:847'872 bytes
First seen:2021-05-12 12:34:10 UTC
Last seen:2021-05-13 11:58:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:vX1bYzzy+455jKmYpoaLTqvw/TAq3SGfnjI3:98zyh5jKmQoxvI8qiGfn
Threatray 4'878 similar samples on MalwareBazaar
TLSH 9505129D3314F2CEC867C5718A54AD749B31BC6A931B46179817A2DCCA9E88BDF042F3
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/155302/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.CYQ.genEldorado.9718.26079.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/779847
Signature
.NET source code contains very large array initializations
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected unpacking (changes PE section rights)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fd5cd7dfa99788f1a9e7f8bcf9de43b2577bb43623eae2c53b4b676010e93088/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-12 11:40:32 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7vonpx5js6epdkph7c6ptxsdwjlxxnbwepvofrj3jntwaehjgcea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
AgentTesla
97ff929ee442194764c50634c91ddc16739424c6eacf90383cb36a4a4210d074
AgentTesla
a2f1773e4b9146563dbf711ca1462448a7a847f8b6660424f72faaa5fa9b20d4
AgentTesla
a89fb0409ae1c4b7693d58b270738a2e36d0e2f5b099550fe27353876cba6b6b
AgentTesla
abe6a77fefdede7de287d151689f87a3f59eb496d94351f4085b3bc1a6b755c2
AgentTesla
b4eddee0ed85389b25b45ad11c5ba9e581e667e6fc5aa32abae9d4c6b915845e
AgentTesla
b5be17b9a7cb258eeeb27f08c5ba197c47e87b052ce41b150e9945b17d1308c3
AgentTesla
c8b1422e0faff76b67b7cdfe2e9be0ba799522e729aba5cd191b1809740a7fd1
AgentTesla
da292ea9e3cda3911d3e6023e9ead0e663a14a1d089cabe7830d46f9c27caeaa
AgentTesla
e99bae3896aa527b7e77c3ecda493364d913cfa2ddf1ef0b1a072d9f4289764f
AgentTesla
+ 4'868 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210512-nlw7zjx34n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/fd5cd7dfa99788f1a9e7f8bcf9de43b2577bb43623eae2c53b4b676010e93088

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe fd5cd7dfa99788f1a9e7f8bcf9de43b2577bb43623eae2c53b4b676010e93088

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/155302/

Comments