MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b22e67e78286d02af1eda50011ede35eb6fc63454b7f4ee234eb714250c365f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b22e67e78286d02af1eda50011ede35eb6fc63454b7f4ee234eb714250c365f
SHA3-384 hash: b346147c6413038a1d4f578e742f1d1e5ca4cad5c911766a870c0c3ded1aa8cb63ddbf1248db1e50f9c0e78c257a208a
SHA1 hash: fea02e96f91414ab147106697caeb48a02b238fd
MD5 hash: 37e24f915493f8add1a8d1bdd86c55ea
humanhash: thirteen-south-mobile-missouri
File name:Offer10089885_BMElectricalWholesaleLtd_08_06_2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:790'528 bytes
First seen:2020-08-07 13:21:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:mJ9LQIqD0K0sPsbs2JKKmj/n8vQWA+RTQNB:mJ2QK0sPsbs2wKmjnO/
Threatray 10'704 similar samples on MalwareBazaar
TLSH F6F4193CBA81F406D53C5531C0E986F062B2AE46AB52CA1F26D63F5C7F6364F7E4508A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.inclusion-souken.com
Sending IP: 150.95.183.80
From: Paul Newman <paul@cnode.io>
Subject: Emailing: Scan0007, Scan0002, Scan0003
Attachment: Offer10089885_BMElectricalWholesaleLtd_08_06_2020.rar (contains "Offer10089885_BMElectricalWholesaleLtd_08_06_2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/41636/
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.8832.390.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/415285
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Installs a global keyboard hook
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 259892 Sample: Offer10089885_BMElectricalW... Startdate: 07/08/2020 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Found malware configuration 2->39 41 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->41 43 2 other signatures 2->43 6 Offer10089885_BMElectricalWholesaleLtd_08_06_2020.exe 4 2->6         started        10 SafiGroupPlastic.exe 2 2->10         started        12 SafiGroupPlastic.exe 1 2->12         started        process3 file4 23 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 6->23 dropped 45 Writes to foreign memory regions 6->45 47 Allocates memory in foreign processes 6->47 49 Injects a PE file into a foreign processes 6->49 14 AddInProcess32.exe 2 4 6->14         started        19 conhost.exe 10->19         started        21 conhost.exe 12->21         started        signatures5 process6 dnsIp7 27 mail.safigroup.com.tr 78.135.65.66, 49755, 587 PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR Turkey 14->27 25 C:\Users\user\...\SafiGroupPlastic.exe, PE32 14->25 dropped 29 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->29 31 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 14->31 33 Tries to steal Mail credentials (via file access) 14->33 35 5 other signatures 14->35 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5b22e67e78286d02af1eda50011ede35eb6fc63454b7f4ee234eb714250c365f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 13:23:11 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmrom7tyfbwqfly63jiachw6gxvw7rruks37j3rdj23rijimgzpq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2c8da0da6cbab2366291deabbb773bec304a9e49c87982a04d6ee33c712cd642
AgentTesla
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
516b29be6f0d91a249adca2b26381bfa5b90cf6a643d1b621095c6425a74795b
AgentTesla
5eff8146838a95a421d926b71fdf0a78a67d822978e0cfb00a5d8e4d24b4f983
AgentTesla
8dca506f397a02a7dced3a515980d4eca9a2a05a0f30e8e2205cc26aa44138b1
AgentTesla
bc115dc2be13d9053e04bcac9c102a26391d7c76134d9364cddb798e800949f7
AgentTesla
c787a047333210934bbea458801e55c8101fad480e119d4b41b072e7b921b60d
AgentTesla
d17de71fad23c19ea4e181c8fe33be0fc230d15be13e6d3c755c77e7ff1519d5
AgentTesla
d3dc0fad4580b2c3d0f5bfe27fd99d66b20f2a2c65c219218f9e6628a9df5d2b
AgentTesla
fb98803c42920bc5019d764153010c64f12bc6543e2a1a9e1378185b4e434edc
AgentTesla
+ 10'694 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer family:agenttesla
Link:
https://tria.ge/reports/200807-b53asbhfgn/
Behaviour
Agenttesla family
AgentTesla Payload
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b22e67e78286d02af1eda50011ede35eb6fc63454b7f4ee234eb714250c365f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c971d13a15de6a80350f16831b7b11d0d8992e51be5f81e3580bb35ab6de871f

AgentTesla

Executable exe 5b22e67e78286d02af1eda50011ede35eb6fc63454b7f4ee234eb714250c365f

(this sample)

  
Dropped by
MD5 9d156de9fd0e301869075cf99c3de0e3
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/41636/
  
Dropped by
SHA256 c971d13a15de6a80350f16831b7b11d0d8992e51be5f81e3580bb35ab6de871f

Comments