MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4
SHA3-384 hash:	b53300c13454c5a8cc594f98c3849897d19afabe91a8b5d2432cfbdc663c58a4c487e85a7c6017775bb577c741c2d3c2
SHA1 hash:	fd0bf3b672773d252ac7b9dea41ed2b0525822cf
MD5 hash:	a7d005a501608e0a7cda41624175f5fe
humanhash:	whiskey-alpha-oscar-sweet
File name:	HSBC Payment Advice_pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	774'144 bytes
First seen:	2020-08-03 06:51:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	831ec412be4cd06baa632b18086fedb4 (12 x AgentTesla, 6 x MassLogger, 6 x Loki)
ssdeep	12288:jZnVKDTViiHWs0H/3b6Wx/wtmqOFOUW3WvbCwA4vRyvCcBeYjDg6VBn:Z44isf3bXot2CW7RyvLB5BVl
Threatray	11'674 similar samples on MalwareBazaar
TLSH	47F4AF22B6E04533C1672A7C9C1B67749CEABF107A68A8762FF51C4C4F3969138F5293
Reporter	abuse_ch
Tags:	AgentTesla exe HSBC

abuse_ch

Malspam distributing AgentTesla:

HELO: vps12232936.123-vps.co.uk
Sending IP: 212.67.215.65
From: HSBC BANK LIMITED <advising.service@mail.hsbcnet.hsbc.com>
Subject: Payment Copy? - Tips Ref: [MT103] / Payment Priority / Customer Ref: [37035930FS37289]
Attachment: HSBC Payment Advice_pdf.gz (contains "HSBC Payment Advice_pdf.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/37389/

Detection(s):

Win.Dropper.Smdd-6956905-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Sending a UDP request

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/407295

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Initial sample is a PE file and has a suspicious name

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4/

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-03 06:53:08 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gcqprnw4gd5tvhtesfe5t2jphg2qwtm4lfpz2xceaddczkwqw62a._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

1213bf9b96c3be3807bcc5a361f913dda92aa985ab0d09cec4d4b75dd78f6dd1

AgentTesla

28f4c1738d5f9ed88b07a8266e674c22abb35e74bca8dc3fa6f1679f14f2a43f

AgentTesla

41f6638f1e6ad1d8aee7d3d0ccd9a39af59e340b2ad2074d25d72dc8556855d6

AgentTesla

4b2ba5e0907fa5c1cbfd980bee03483ccce1d11bdcf924e90de7a7c72ded2ef9

AgentTesla

534448acf886c50b7172a770f596924c2924dd229867f7e94e3f5250adde47fa

AgentTesla

6c198cde01215ddc3644821cac16edead4b41dcb19f2ea0639e57b27347b8b78

AgentTesla

9ebeb5ba44225161419dd3306fc3dcd8aae12ca658e582ad3e5b3c6bd744bca3

AgentTesla

b2c27e47afb94c3bebf71559a6fd0195ad330f4fb126bf7a2002c6c1ba995dd4

AgentTesla

b89dcfcb93658704c904004a6266ed755b71c233de1ee97b0026a17af3462fa5

AgentTesla

+ 11'664 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

upx keylogger stealer spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200803-hwfpwjles2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar