MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 278ad81624b893327658b221bc291559afc775fb5ca85e33c70901bfc45fad83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	278ad81624b893327658b221bc291559afc775fb5ca85e33c70901bfc45fad83
SHA3-384 hash:	65c6523a749d646722ec23f7158148568ebf5227338fecb9bd293df24683d9e7a7f4153796730979fa68337dcd8ac1bb
SHA1 hash:	057f4f87626f82a05fb633e3b46b284285a5a1ad
MD5 hash:	3e678747639c04bab17e6e15f2970500
humanhash:	hot-indigo-magazine-sierra
File name:	EMIN Vietnam Joint Stock Company RFQ_xls.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	836'608 bytes
First seen:	2020-07-20 07:22:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:kOuK1q9I6/kVdSC0DyBEE9tqYrZcWJUgNIpxR4UnhR9gu/wHod+ik4g8ylSoD:kOuKudWCE9LLJ7NIpx6MJgowtrE3oD
Threatray	10'656 similar samples on MalwareBazaar
TLSH	F705E0C966A04400CAEDAFF95EA2CAB44B357C01F5F2930F1FD0AD9B297A793D544722
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: server90.a2zcreatorz.com
Sending IP: 72.18.132.9
From: EMIN Vietnam Joint Stock Company <quannv@emin.vn>
Subject: REQUEST FOR QUOTATION FROM EMIN VIETNAM JOINT STOCK COMPANY
Attachment: EMIN Vietnam Joint Stock Company RFQ_xls.z (contains "EMIN Vietnam Joint Stock Company RFQ_xls.exe")

AgentTesla SMTP exfil server:
mail.tlshellfish.uk:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/28540/

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen2.52265.13230.30912.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Creating a file in the %temp% subdirectories

Reading critical registry keys

Creating a file

Deleting a recently created file

Reading Telegram data

Running batch commands

Creating a process with a hidden window

Launching a process

Sending a TCP request to an infection source

Stealing user critical data

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/278ad81624b893327658b221bc291559afc775fb5ca85e33c70901bfc45fad83/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-20 00:18:58 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=e6fnqfrexcjte5sywiq3ykivlgx4o5p3lsuf4m6hbea37rc7vwbq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

0698cbff335f16544c0a97a71df4f0e52ee4dbddf3cadad2ee0ac52103ea8ed2

AgentTesla

42482d36162c303c7dd784ea301aa70e666cfb2659ccbbef0424f4e1081c449f

AgentTesla

662e6858fb2067c38af99173b7a3201a148bd9104771badd96868bccc20ec687

AgentTesla

6b60f1aa605dd8b1a2f2594084e7df975eaf8ca36d9334b73b0b44f3b6449b6d

AgentTesla

72a5aa9ec7064e9475d3f4a6958b6ba04a99e7837bcf48b254fe32e128934318

AgentTesla

77950def119777d1a1a47117910bbe7f1579bd91b9295f46f0ce31bebaa54104

AgentTesla

880bba3fa9d2e255ad00cc35d53aa361bcdf739d16064d669a4b21b9a8034f73

AgentTesla

9c33a1f6a337e39a99c4480f19e63fbaeee191defcd51c8a908e9af9da8e115c

AgentTesla

ebd23b0402ce1f9f8d45a37ec77fc89381869a3399aa2d405830e7eb05299ad3

AgentTesla

+ 10'646 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/200720-1qp1dwmkge/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/278ad81624b893327658b221bc291559afc775fb5ca85e33c70901bfc45fad83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar