MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a7a9cb17f7c3d46e18a60c4201edbb8e93fe20723b34a9967a0fb67d2bf7896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a7a9cb17f7c3d46e18a60c4201edbb8e93fe20723b34a9967a0fb67d2bf7896
SHA3-384 hash: 4602dbfba3d673ba746cd8884f0cc315cf4c5bb7ffb7ab32c8b215bede526c4872a6d47b3f936996189ec3c2c56b2bc7
SHA1 hash: b92bb7ba1c44eff1318b8b4c1b454c51b9861e29
MD5 hash: 49a80e270deba8eb1d747c41074ecbd0
humanhash: lake-montana-kentucky-table
File name:Zahlung.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'458'688 bytes
First seen:2020-04-30 12:13:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:FAHnh+eWsN3skA4RV1Hom2KXMmHanTV8B8u26OKDc2JrxaJtD98JeEb5:0h+ZkldoPK8YanTV8BZFcdtR8Ew
Threatray 11'087 similar samples on MalwareBazaar
TLSH F265CF0273D5C032FFABA2739B6AF24156BD79254123852F13982DB9BD701B1273E663
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s17583606.onlinehome-server.info
Sending IP: 82.165.194.211
From: Björn Höcke <info@artmaticeg.com>
Subject: Zahlung (PAYMENT)
Attachment: Zahlung.zip (contains "Zahlung.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 10:49:32 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lj5jzml7pq6unymkmdccahw3xdut7yqheozuvglhud5wpuv7pcla._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0fb5088d1d17ea2b0c103cd9472ceef9a07391e33d27d3315c8391927212565a
AgentTesla
1296fea5be2ddeca7afbb565183c83b9a5660eb1fe98942bb2f048be7b237f6c
AgentTesla
51558f41331f2345cd146dc9705f48e8a6fdc425e6744658ff2ea53d42d34ae6
AgentTesla
551b22090262c7afc91b582469fd348fb365ea1ac39cf8ce75b55f069feddfc0
AgentTesla
5dd114148f9cf40a9d80c1631cc582a4f19ee62d5f64c1b33e28a6ac5c5b0d53
AgentTesla
5f409bddf5b4efe31ec833332774381385c1a31e3e2d8e5e3b2d2f934be0a5a7
AgentTesla
826f7d92ad363ef5588a9d983b76899cd45279c201e2af459a38ef034527bf06
AgentTesla
8ee12529c5e5e47ab9c291af49e47c41483f67ac4e9054aa7697e58fa625165f
AgentTesla
ce172721c1da61b4401d9b00414c050c72d33835962489ee6b59ddd4bc42ed37
AgentTesla
f0b3f2e5bfee0f37c39392331af6a27a89e03a077d9e8084f6c0a5ffb843b27d
AgentTesla
+ 11'077 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ce641e037ba8297030ba24b9eec4865d

AgentTesla

Executable exe 5a7a9cb17f7c3d46e18a60c4201edbb8e93fe20723b34a9967a0fb67d2bf7896

(this sample)

  
Dropped by
MD5 ce641e037ba8297030ba24b9eec4865d
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments