MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734
SHA3-384 hash: f0a61826dc62e91652f9d1370e31099c4da19949b8e5e49a6897c8d818de4e72bf8fa79fd188dc90ece00a3eb96a10c0
SHA1 hash: 7d2921a53ded62e8cabbc23a1ce7b62aad9b1e0c
MD5 hash: 45fe665788aea0df18676139aa549c73
humanhash: yellow-oven-black-south
File name:Na7NYczCCu0fpRw.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:245'760 bytes
First seen:2020-05-04 17:53:12 UTC
Last seen:2020-05-04 18:55:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:GsGX4Yt5+AQmzWLSqS6KTMzKT4N6l7dp7NgbSbHikUHsjpzcZ7UObdL7:aI657QmqLSqAe6l7P7NRUHsHO
Threatray 73 similar samples on MalwareBazaar
TLSH D134167D1DFD223BD1A9C2F5CFC1C863B409E2BBA016597654E29354825BD833AC327A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ecleris.com
Sending IP: 37.49.230.216
From: Marlene Rasi <mrasi@ecleris.com>
Reply-To: Marlene Rasi <mrasi@ecleris.com>
Subject: Order Ready
Attachment: invoices and Old account number.rar (contains "Na7NYczCCu0fpRw.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44197.24534.30601.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Siplog
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 08:35:03 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7v2ocpxba7gmizjxwdmebmo2fxdrmbdgtzrkalkttospv3xk42a._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
0722cedd5a2e4a5a4c94ac988f14800a6a83a8c7147f7ef52b47ae86571384e2
AgentTesla
170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa
AgentTesla
1d98e18806cb0b478899854bf39ff2388225501a109405db1816066643224ce8
AgentTesla
35cca711eeab74520897fa7d78a5228861e9eb0bd2f66e1aa3810784acf4f11c
AgentTesla
517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9
AgentTesla
97b8bdb2c3d831301d68b883fea274703bd497462caa192f6a09130a0f42d10c
AgentTesla
b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d
AgentTesla
ba783a6dc1161f2de26ff815457e19aa6918ad4d6bc87f048bc00975ea4a210e
AgentTesla
e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e
AgentTesla
f7556976536d96e5b02f426496916b127c6159ccb3b66377fe09db2e5a6a6cd1
AgentTesla
+ 63 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger spyware stealer
Link:
https://tria.ge/reports/201109-5wn6263nvn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
M00nD3v Logger Payload
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4d32b62438636d2ac46f8380e2743c5d3bc07eb282c0108b0d5953fa4f467f93

AgentTesla

Executable exe 1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734

(this sample)

  
Dropped by
MD5 62d6a8b37c838b2c522b977df642b91e
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4d32b62438636d2ac46f8380e2743c5d3bc07eb282c0108b0d5953fa4f467f93

Comments