MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f02252363a7f372edd004c7add17a9cf575abf38045b25c5e2e21fe16cad7cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f02252363a7f372edd004c7add17a9cf575abf38045b25c5e2e21fe16cad7cf
SHA3-384 hash: f51e8423f1fbe3931d9f31674a82c71ed888281b81f07dbc4ed66980472e2544bbf49224ff332ae16deef844c2c4ba8d
SHA1 hash: 4382d215b32b044bc6dae00f16d4902b6b038660
MD5 hash: 3eb616b0d2bacfc55f7fbd3ccac93cc1
humanhash: jupiter-indigo-whiskey-johnny
File name:Payment_Copy4_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'283'072 bytes
First seen:2020-04-12 08:49:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 60413524c347373cf487078cadddb576 (4 x RemcosRAT, 3 x Loki, 3 x AgentTesla)
ssdeep 24576:1CAd9LxjhH70lCnAm7Qe8rPW9Ko8kFdZOM1SnnzqHw:1T4bmBKPro8kgr2Hw
Threatray 10'956 similar samples on MalwareBazaar
TLSH 2755AF22F6D29C33C5321A3D9D4BA7A4993AFE002D3859463FE91E8C5F396923C152D7
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Remcos-7662488-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Siggen2.46761.4057.2023.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-10 12:58:26 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f4bcki3du7zxf3oqatd23ul2tt2xlk7tqbc3exc6fyq74fwk27hq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
291c6a303c1015ad7801e1468b5f630fe73914182fbde360754ece704707a4bc
AgentTesla
381890c0b8c5955bb3f6c229f966fe8d6fc2bc707d9480752e1fed75bbc5b470
AgentTesla
47c8fab622177ddaa495e4b9294c0949be6c7572ef15f831ee7c326af0200ccb
AgentTesla
4a6067b076edb6669b238f77c51ee8408cb4708f7c8b99ddddbca3b4b8e304a2
AgentTesla
57df36fc7452bb8ef66e18f5ca34deace335039f1ffe1119c975b547a788377e
AgentTesla
68ee120de5e3ced8f322781d78428addf813a759ce03f61c12d96ab5184f4515
AgentTesla
72781a1a099ec975bbd835764501e4e9e5b87455c004a46d9a816503913bc194
AgentTesla
80eb41c227d25497e75d5d5bde1e26d917d997c5a7dabdcc31c31ae1008a7ced
AgentTesla
dd4a43b0b8a68db65b00fad99519539e2a05a3892f03b869d58ee15fdf5aa044
AgentTesla
efea44ec71f452d9aa0f866f7634a5dcd7e9ea9cf0964c2143a748e410e10ffc
AgentTesla
+ 10'946 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::WinExec
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments