MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35
SHA3-384 hash: d17781c0235b14496154a4a2de4ca4b28321b44531261f7fb690cda92aa597d3f6899ed5606b01b1459a31dc5dac382d
SHA1 hash: fcd9c595168b04aee6be154e1204d63e5a676c6c
MD5 hash: 4e0a15308adcca795ccc1d71b6e0f09c
humanhash: nebraska-twenty-indigo-sad
File name:Company Profile and Quotation #20200804-4563.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:865'280 bytes
First seen:2020-08-04 13:36:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4bae7147ec04d935db5914fb885560bb (11 x AgentTesla, 3 x MassLogger, 2 x AZORult)
ssdeep 12288:ez7G/lsTGbsiZQfwgZLObQINANWz3O6Ex7FxBwWR2tVU9dA44Dsy2ii:eetNafLLOM9QKlNwWwtVA2Dsyfi
Threatray 11'766 similar samples on MalwareBazaar
TLSH 0F05AF3EB3A08437D1B2163DFC1B6FA4583EBD112D289A463BE4DD4C5E386513A2D297
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 163.com
Sending IP: 95.211.208.25
From: Jing Chen <chenjing19827@163.com>
Subject: Company Profile : Quotation Inquiry
Attachment: Company Profile and Quotation 20200804-4563.pdf.gz (contains "Company Profile and Quotation #20200804-4563.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38744/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/409521
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:38:11 UTC
AV detection:
42 of 48 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j6ue3xxhbrmvc2sxe75ctp3q4vefkbmstggpyb5zwk4agjlvnm2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0fbc9c7fd0d2dc46b01887d635c8b8be1838151a46fa392a6e7e77e7aeb63d2f
AgentTesla
15a8bd5b4fa088cd06bacf4dd11ec0616f83a97a139c9ef5d9d9be3d08e0e06a
AgentTesla
673aa6ede02270b33f4a7058ec4e31eabd688ca4c75037ed4a7f92470a42a271
AgentTesla
67f95900e94aed84cb50b3597df4b89270faa3b23ff0c9c6eb2398eb69c096bb
AgentTesla
988ff31d08c32bd5ab285d8d10f5dc101aac63504332564092f7b25340f6a241
AgentTesla
a3ceedffc1e4f81695df3b06af7a12059d534af798313e27d010dd2116e1a2fa
AgentTesla
a5efbcb25b4339ea9e004364c443afaadb86353cce9dcd9508115bda5a57be88
AgentTesla
c69797064cbb8d3681f5a780a37b13707b4a9e5c02cce806de89956c85688e6b
AgentTesla
c7a4cb30492911fff0eb668a1b5d1bd4c97b968329a81e53ca164e4cc7f5d669
AgentTesla
c82a750c5a0dcc2a923f97b3bfbba13fd302144fdcdab020f7c7c94e24892807
AgentTesla
+ 11'756 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200804-55jvpbev6e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fd1df13c26fd7297b4a1b2ef754ecbd976ba9deb0fb79c67cf86f5dc28c77f13

AgentTesla

Executable exe 4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35

(this sample)

  
Dropped by
MD5 88175746fa0698a2921cd2eb4fa8967f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38744/
  
Dropped by
SHA256 fd1df13c26fd7297b4a1b2ef754ecbd976ba9deb0fb79c67cf86f5dc28c77f13

Comments