MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58322659acfc21d063a2acb0d64ea2846d21ab2e256b0ae4f83646ff03bf2387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	58322659acfc21d063a2acb0d64ea2846d21ab2e256b0ae4f83646ff03bf2387
SHA3-384 hash:	5e77e53feaa2bdd3352c240d253069c4b2e91539c60c85a83def98a01ba05a0fc1c6c840ceb6276382d74e4fb350cbe1
SHA1 hash:	8f585a35e3fd023a736b03444acff61497ce4668
MD5 hash:	2310b77f6b9d410540dfbf00bb714364
humanhash:	purple-india-jersey-kansas
File name:	objednávka_PDF_______________________________________________.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	459'264 bytes
First seen:	2020-08-08 08:03:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	12288:7NSdLbn1gjUj2uyU64/B5Nta4VEYixdhQyTfdiEapgrpiA:7NKLb1gjm2rT4aYgdhHIEbQA
Threatray	10'647 similar samples on MalwareBazaar
TLSH	6BA4126817FD6BB7C9FD0AF5998E344056B89447AB67E3202E0534BE28A370047E17E7
Reporter	abuse_ch
Tags:	AgentTesla exe geo SVK

abuse_ch

Malspam distributing AgentTesla:

HELO: auto-deal.gr
Sending IP: 95.211.208.25
From: Olivia<xasapi@auto-deal.gr>
Subject: RE: objednávka
Attachment: objednávka_PDF_______________________________________________.gz (contains "objednávka_PDF_______________________________________________.exe")

AgentTesla SMTP exfil server:
smtp.erneralduae.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/42051/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/415695

Signature

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Suspicious Double Extension

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/58322659acfc21d063a2acb0d64ea2846d21ab2e256b0ae4f83646ff03bf2387/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-08-08 08:05:06 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lazcmwnm7qq5ay5cvsynmtvcqrwsdkzoevvqvzhygzdp6a57eodq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

50529809a9b92f2b353e94a27b850f7be76f820c9a413a5968d686026936c133

AgentTesla

5092d9ebc85e835f7ef16d20b935cf58cc52715c0cfdb88a2723d3a34f9b1526

AgentTesla

63f3c0c57169df7444e25fcfcc6626bc14d6e85dea12a1b6bb137e780f71cbb5

AgentTesla

983642426c54efb09b590e6f4344483d07b99a9e3a2551d504d4293183d701c3

AgentTesla

a13424875703c2b22381b0f2db797498bca3ac5b677e2e30ae3441aeff6b9e0e

AgentTesla

a990373e6225384bd1bab3441dc0cb881f1e03f51f83f7923ca6c9ff228bee5c

AgentTesla

acf7a212615c205ab87f28d19c97bc50fb93d8568f3960b06d2174d1c28f355e

AgentTesla

b3349406861e76bfb84f4757a646c3fe94eb5e1cd27abeeffa48aabb6c8fa4d5

AgentTesla

c8c4219d39faa8c727e9905b5156f4bc71c4bfbb4c9495c8a80be7020cd4380f

AgentTesla

+ 10'637 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200808-gn8hf1s73e/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/58322659acfc21d063a2acb0d64ea2846d21ab2e256b0ae4f83646ff03bf2387

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar