MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17b3763eae8262957e49956dbc63b57ba57ce91b49bc7d538dc1e01cabd52450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	17b3763eae8262957e49956dbc63b57ba57ce91b49bc7d538dc1e01cabd52450
SHA3-384 hash:	3972a320855fbaa74b9781c02dc4c5a067b4a3566c490695edf29a4bf92d9e354e575bff892a441ed00edfcd0cbf7d39
SHA1 hash:	892aad2b7765d9c56a333448868c965b2b4c7020
MD5 hash:	a342dca1ced2102c6c8e567df3917b98
humanhash:	earth-thirteen-virginia-robert
File name:	Purchase order.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	941'568 bytes
First seen:	2020-08-03 13:44:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:0mG2aWt0EefIZ7HcDE8hxcsG3Z2qkp/Cj1lB509smCxP7r9r/+ppppppppppppp7:dG29vdZ7Hj8rGp2qklCj/f09U1q
Threatray	1'019 similar samples on MalwareBazaar
TLSH	DB159E88E6805554EC5A5F7A5932C8319922FCAF9C36E34E24ED3D2F3ABB3991401F53
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: chingcheng.com.tw
Sending IP: 209.58.144.239
From: daniel@chingcheng.com.tw
Subject: RE: Official purchase order (PO.4029530)
Attachment: Purchase order.zip (contains "Purchase order.exe")

AgentTesla SMTP exfil server:
mail.multitec-bo.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/37878/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Creating a file

Using the Windows Management Instrumentation requests

Unauthorized injection to a system process

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/408015

Signature

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/17b3763eae8262957e49956dbc63b57ba57ce91b49bc7d538dc1e01cabd52450/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-03 13:46:12 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=c6zxmpvoqjrjk7sjsvw3yy5vposxz2i3jg6h2u4nyhqbzk6veria._file

Verdict:

malicious

AgentTesla

1b3b81cd526d60f60fa1c193ba72438ec0f1c4059d5d7f195059d1aacfb453e3

AgentTesla

275537d87441c354b859273e0729177d78f185bebdd9a86fac240a3f168a80a3

AgentTesla

3631b6f02663cc48d6ca8a8396a168c0d0204326c8d3ff66b25e013c7e8d5f93

AgentTesla

4068afbd6b271b237f97b260260971d8d2cb6b7092687eabc56e3353567f3d50

AgentTesla

4f965aee8b694528d2d11d5a80eeee466959650ffcd12b5f0fc28d3a11709e27

AgentTesla

5a5ee7a7accc9dea18429c75f62db226599e96d50cdf5f1fec7d5e40881278b2

AgentTesla

6f2ed9ee33724651d7fb52edc4dbb3bfde3c19ca12cf5e990952d392305d1c20

AgentTesla

946bf0933ae9952f715bb7405c52fe8ec4ef71bc5ace58859b1c3ae8d93e253d

AgentTesla

d83429370b6d814b6ff67dd1736424db4e11e39ee745867f09c98f49fae4e1fc

AgentTesla

+ 1'009 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200803-f3bb9j8e1s/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/17b3763eae8262957e49956dbc63b57ba57ce91b49bc7d538dc1e01cabd52450

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar