MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14adf4dd13033d8ed032a7ebd489a056752df681ec958d92b92d8776d0387f7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	14adf4dd13033d8ed032a7ebd489a056752df681ec958d92b92d8776d0387f7e
SHA3-384 hash:	b5b5d0d70c6314ede22562568f4c520a97789ba930989cda78d758246570adadec0a48139f312ce33464fda8888b2fea
SHA1 hash:	5754c79aac3685bfd19bf0b99dd87e80e714a2e6
MD5 hash:	04b15308fe8f1c0712620002b8a31cea
humanhash:	diet-angel-floor-mirror
File name:	MV TBN.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	582'144 bytes
First seen:	2020-08-18 12:47:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:sZo/4EcmZHAFaxmVmie9bngPyN8ZyptZAB6AC0QaoI+d3eSVcph1OapZQ3E04P1C:sW4EcmZHAFaxmVmie9bngPyisjZVBQIq
Threatray	9'229 similar samples on MalwareBazaar
TLSH	F9C4E05C3090F1AFE9EE8EB5A8341C34576027171217FF479D53AAF45BCDAE2AE400A6
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: panocean.com
Sending IP: 194.186.0.234
From: 夏荣慧 <jayden@panocean.com>
Reply-To: acounts.cargonave.br@outlook.com
Subject: MV TBN EPDA REQUEST TO DISCHARGE 10,000MT & 25,000MT OF HRC
Attachment: MV TBN.zip (contains "MV TBN.exe")

AgentTesla SMTP exfil server:
mail.conshipping.ro:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/47848/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Enabling autorun by creating a file

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/14adf4dd13033d8ed032a7ebd489a056752df681ec958d92b92d8776d0387f7e/

Threat name:

ByteCode-MSIL.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-18 12:48:08 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=csw7jxitam6y5ubsu7v5jcnakz2s35ub5sky3evzfwdxnubyp57a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

05568298144f10100f3882592a8be0a1754c579f581a3db6316d014c7f8ca8f3

AgentTesla

144903e623b5997d6856a3880393ebe02411b41c1aec3460168a59e2ec00aba5

AgentTesla

68b6aee99f9d4bf184c77beacb3b8a418f84a7efa606e5bd7f4fd57edb904054

AgentTesla

6dfcd16fd49c65c541603ff162b0614aabfc70548455b21c3877240855df12c8

AgentTesla

723071d4e54bdfd50d7ca47b02f67ea70aa59ddffbab36d8dbc5eadfd4b799be

AgentTesla

7cada1e2ded7a265c041691dc017fa160e9c47a4a1c866a3ae54a3b5f4de0e89

AgentTesla

9b71ca5e5e3faf0bd77b6f6d370d5aa32dffd3e2019b15624a544487895f82f5

AgentTesla

cbf2153e97011d74d46c765fe0209f95d26671bd0f640322131f02895898e50a

AgentTesla

ceabc6af60d4bf77f5610a2194219bafeb96bd7fc94ab35d6ae51e7459298d7d

AgentTesla

+ 9'219 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer persistence spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200818-ymqbyqqpza/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/14adf4dd13033d8ed032a7ebd489a056752df681ec958d92b92d8776d0387f7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar