MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350
SHA3-384 hash: fd592263b3822cfa8b8c767bffc211fd26d0ec48db9e9427c78e34250ec0bd589677cee1ab4b13baa4ed4e45f809f7f5
SHA1 hash: 3ed53355aba47cda097eb923e0cdd199cd4333a4
MD5 hash: e92974c3fdcc2cc2e123c95c1acb8fc2
humanhash: papa-lithium-monkey-colorado
File name:Order003739.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:446'976 bytes
First seen:2020-06-22 08:17:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:lC5ZJgPt/WYciLoLCkBatl7Tdzb4Ojrq/jiB6v9nW41KHzbGNxT5Wrf/F1+/h1RI:l6i8BWvdzb44rCE61WpHzGKj+p1
Threatray 10'667 similar samples on MalwareBazaar
TLSH A794EF043FA44B1EE66917BD1621525E237223EA5A15E2CC18BBFC8D1D76F43828DB73
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-740601.hostwindsdns.com
Sending IP: 104.168.165.92
From: Scott Wilson <sales@saulkalne-lv.com>
Subject: Order 003739
Attachment: Order003739.exe

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12511/
Detection(s):
SecuriteInfo.com.Artemis63715DF92E44.17574.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 08:19:03 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lq7f6rct2uff4e6qvqof7lvcln32ebchw5a7wcx23a5wfgc2ynia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b
AgentTesla
1fe9e9760604fed048445b3c79c91d30a9b1cf75a2a689c48181724a91df38e3
AgentTesla
2eebb01bf1beb78cf343f5465a600eaf0c17af2bd28a7133d41581e8fa2ee5a4
AgentTesla
41f79628a7ff72d611f593286f5b70a51c72f8359e6600535b1b3e9772fd7c0c
AgentTesla
5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3
AgentTesla
6cb654eef04d1ee111df21c38103ff082fe9e035e46c036ebecc0bc21d3efd80
AgentTesla
798676352c75523109a4cd08f282ae658bdde5ba1e77b45d19c8fee68115d3df
AgentTesla
b8816e0b814bc0528b84fe7e0e89cf5e8168b64a8028d8610510a59f3f7c2268
AgentTesla
bb398328320c76f194dc38b13275c4fe564cd0c85457fc83e62643110cfe0631
AgentTesla
e8454346c57024c395766f6c82771a58c6f03cbaa15871646cc197aae5b73461
AgentTesla
+ 10'657 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200624-pdnbd3f5za/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12511/

Comments