MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c04fa0c37294770f966ab9f8e848e45c574364e07b0c27e062e79ca8fd6a46d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	0c04fa0c37294770f966ab9f8e848e45c574364e07b0c27e062e79ca8fd6a46d
SHA3-384 hash:	ac133d8eef639fe630060b17135b56c45777cc7d989f16279afc8a976403a2aa5b238d054f0d600b29fc250572503ee7
SHA1 hash:	210b53bed909d7a44785e59f4f0fda0e1287f736
MD5 hash:	0facb0cb843664cf5356376b53fbfdc3
humanhash:	sweet-jig-seven-asparagus
File name:	P O...exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	872'960 bytes
First seen:	2020-07-28 14:14:56 UTC
Last seen:	2020-07-28 15:02:21 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:QxtfAcIWX+sCp2PnEkcMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMM+:Q1PnEkcMMMMMMMMMMMMMMMMMMMMMMMMa
Threatray	21 similar samples on MalwareBazaar
TLSH	B50527106290576BCAA78AB13927D4B00623ECE8FB21D9761DDEFC8B35F56F92183153
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: ghhaewae.com
Sending IP: 103.99.1.143
From: Shohrab <shohrab@ghhaewae.com>
Subject: FW: [BULK] IDFL20-312820-821 Samples Received Confirmation
Attachment: P O...zip (contains "P O...exe")

AgentTesla SMTP exfil server:
mail.mystboutiquehotel.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/33774/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.373.2079.27325.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Forced shutdown of a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/400544

Signature

Antivirus / Scanner detection for submitted sample

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/0c04fa0c37294770f966ab9f8e848e45c574364e07b0c27e062e79ca8fd6a46d/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-28 14:16:09 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bqcpudbxffdxb6lgvopy5beoixcxinsoa6yme7qgfz44vd6wurwq._file

Verdict:

unknown

AgentTesla

20fbc5e36ba0a6dd369c5034b410b5e358416c801beba9e8a292f43812215615

AgentTesla

2be5f97b6c1e1a59e9e19b41de55ab517fcd423773ae51b3b4cd18bc0dbcd037

AgentTesla

454a0a9ef4675eff89f9ecc46d46960c5dbb0f463029f34c5037dcd415019245

AgentTesla

6a22fcda5e8d0b7f62e48d79c4754fed28a38a9f1d2b232d771f1e0bdbd3ef6f

AgentTesla

6de5c4939b3168487631c164ffc007b883acc005f689fb91951a06b92b06ea27

AgentTesla

c637a2c035da6eb31a7434fbe3e6a7a98b44d396307aa3710d3c24e9d10300f5

AgentTesla

cb34ccb02de1a3e7fd00c16fd98d509226567c084fa36aad7267fb961b9775a9

AgentTesla

cf8207bd6ead9bcadcaaaad2940956f75d90a67daf6ddb8dc1907900645a5f69

AgentTesla

d90df049d42eb12b0bf2492d413185865d70cebfc3c8c7ad1f8f18c64b0368b1

AgentTesla

+ 11 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence spyware

Link:

https://tria.ge/reports/200728-sg1n5rkyfa/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0c04fa0c37294770f966ab9f8e848e45c574364e07b0c27e062e79ca8fd6a46d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar