MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f6b2c3d63d17c19df0509f3c2f9a1d3952f5e9b76ef8cf8ab00199c32fd3f3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f6b2c3d63d17c19df0509f3c2f9a1d3952f5e9b76ef8cf8ab00199c32fd3f3a
SHA3-384 hash: 3c368ac68425d2f1896b2ccfc381d5f010f726ae0fb04cd883e87f32490a4c6efb4c61c0f1971e57e27e4fa9a178c3ac
SHA1 hash: b209bfc2a4784392509ca6628fa082659c8d766a
MD5 hash: 3122aa0120609d502af50fe809f0be65
humanhash: potato-jersey-montana-two
File name:2020 Repeat Order. PDF File.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:644'096 bytes
First seen:2020-08-11 12:10:10 UTC
Last seen:2020-08-11 13:19:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:0VmVUvj0bsGRtxMbuUQam9OfC1dmrEhbJ:0kZYGRouR9OfWmkb
Threatray 10'648 similar samples on MalwareBazaar
TLSH ECD48D60F9003899B233C52AF1D1FC42225DF103DB165FBBF26B69A44E955C91AA3F4B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.gunasenaputra.com
Sending IP: 103.31.233.6
From: Luci Yulianti <luci.yulianti@gunasenaputra.com>
Subject: Fwd: Repeat Order 2020
Attachment: 2020 Repeat Order. PDF File.rar (contains "2020 Repeat Order. PDF File.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/43336/
Detection(s):
SecuriteInfo.com.Fareit-FVK3122AA012060.16276.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/418752
Signature
.NET source code contains potential unpacker
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: RegAsm connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f6b2c3d63d17c19df0509f3c2f9a1d3952f5e9b76ef8cf8ab00199c32fd3f3a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 12:12:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5vsypld2f6btxyfbhz4f6nb2oks6xu3o3xyz6flaamzymx5h45a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
68b6aee99f9d4bf184c77beacb3b8a418f84a7efa606e5bd7f4fd57edb904054
AgentTesla
6dfcd16fd49c65c541603ff162b0614aabfc70548455b21c3877240855df12c8
AgentTesla
7e1e492f4f7ef7b70a4a0084dcb1be4e13fda74af33dfdaa8b006cf204522627
AgentTesla
878770eb180f92d911dbb519c93aac3b4b63269f45d8af9500f6a144e6635b7d
AgentTesla
8be1266645d388fa35124c58831cbd83fdc9b6faac7ad44ddaf4b0f6b9d2fd09
AgentTesla
9752308c7c33970c7807d4ab84664591488445e4bfc8a403410c9171918636a1
AgentTesla
aee0659a73d3ce6eaaeafcfe545290f95e8e52c3f640fca9fcdb984a17ee27c0
AgentTesla
b745f8bc7dd3ee96edc308bcfbe51d0807a32a31be0a99b56a847d9df84cc200
AgentTesla
d3dc0fad4580b2c3d0f5bfe27fd99d66b20f2a2c65c219218f9e6628a9df5d2b
AgentTesla
+ 10'638 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200811-jvr33aqwbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f6b2c3d63d17c19df0509f3c2f9a1d3952f5e9b76ef8cf8ab00199c32fd3f3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 73a2928c7c27f149f41dab4eab48ce4c53df425d7f1bf3e4cdf8029bc9b133d3

AgentTesla

Executable exe 1f6b2c3d63d17c19df0509f3c2f9a1d3952f5e9b76ef8cf8ab00199c32fd3f3a

(this sample)

  
Dropped by
MD5 5e0559f6253241b3b674c9f4f1357dd1
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 73a2928c7c27f149f41dab4eab48ce4c53df425d7f1bf3e4cdf8029bc9b133d3
Cape
Cape
https://www.capesandbox.com/analysis/43336/

Comments