MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe996a84af7536042d8dd2fa09dd6a46120e5efa926eca53de867f74cb0130ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe996a84af7536042d8dd2fa09dd6a46120e5efa926eca53de867f74cb0130ad
SHA3-384 hash: 6ed4803dd642c010bb7ccd85854513d7ecd4b37fca2847a46bfa2efad43aaea8e4aa80b8704d473cdf061ccdf20867bb
SHA1 hash: cce472607fe7b7fe551621abf2e8b6c2f4e4341d
MD5 hash: 1d814ffc099a1500a247d27636853cd6
humanhash: idaho-kentucky-texas-alpha
File name:ke6dZDC4A76N528.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'400 bytes
First seen:2020-06-12 07:00:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:rXdXAKL/WS0ycHfED8en/BqhJM06g/j4Gs9:rNXAKR0Den/BqhJM7g8
Threatray 10'560 similar samples on MalwareBazaar
TLSH BF94F188369072EFC55FC832CE651C64EA30B8779B1BD347A09326AD994D6A7CF111F2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: JoaquinJulian <Joaquln.Julian@yfai.com>
Subject: QUOTATION REQUEST (YANFENG).
Attachment: urgente RFQ 12062020.iso (contains "ke6dZDC4A76N528.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9141/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.931.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 07:02:08 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=72mwvbfpou3ailmn2l5atxlkiyja4xx2sjxmuu66qz7xjsybgcwq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
4dd2b414c77ad5e60685dd8afbb92d5bf6e3ed11edfa368ae0b8b042c7cec53b
AgentTesla
518f61b23eb64a58b3bc75b881de46dbbf852a3f77ae3677d5763caeb2ad913c
AgentTesla
51d2148d14e4b9f01226e3e53fa73e45fb67bf73037a68e032316954ca7babbc
AgentTesla
5bdd08d6795379ec86f205b7f1be9c2b638fe95a21ec55a8700a7c6d2363f68f
AgentTesla
623e37acf038d163685f53206e0a5090a2178b7b9a4788ab5fbbf24f723d1d55
AgentTesla
6fc32bb95555c9c2ed28b12a287e838afac9a1d7888aa022ce494ce0b75a640f
AgentTesla
b775d2aa67b592663e6302c3978819d81716854281936e3e800720aaa06b25c7
AgentTesla
c11379bd7e59df5f1715c22cb396ac9b5c5233867936e29aa7f27b9e3b410f7e
AgentTesla
c6c1a098e493a3c1352af758cd13093b1d7c395f3d0bd3a5668a6121ec5896d5
AgentTesla
d444059c72ee1b5b335eed7d5985b959c831d4508860222eb277683e77d02eb7
AgentTesla
+ 10'550 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-9f4e2qhhns/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 30a87a46d22e098fe05ade8a3d0b9855c7b5f74d1249ed0486fbc3ba50af3fc7

AgentTesla

Executable exe fe996a84af7536042d8dd2fa09dd6a46120e5efa926eca53de867f74cb0130ad

(this sample)

  
Dropped by
MD5 1e00d493c3c2010f0742f14a3eafbf1a
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 30a87a46d22e098fe05ade8a3d0b9855c7b5f74d1249ed0486fbc3ba50af3fc7
Cape
Cape
https://www.capesandbox.com/analysis/9141/

Comments