MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9
SHA3-384 hash: da2d16b82cc541c150bed54d4e70df70aebda017c2165d119a6c663fac8bdfb7c9e7a11845ac7ef8787371c15cd19448
SHA1 hash: f0faff362f8c8ebc6552cb4a912e629b0a4c23b8
MD5 hash: 43fe85d87b7a3ff5d1cd68d540b2b18c
humanhash: vegan-fifteen-william-beryllium
File name:Purchase Order 38732.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:895'488 bytes
First seen:2020-08-04 09:04:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:gONE5bcPgYxmOy+2Do4pPeRH89fE+Bqc4lqZrw3DfZdeu1rHbsrxQDVnJ+L3:g+HIYxPYVZl/j7O313wxAV
Threatray 10'745 similar samples on MalwareBazaar
TLSH 6215AEC5F5409A59DC1A4D3B89325C914B33AC6BEF06D207708CB6996BBB1C76F24B83
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zmail.rfvallianz.com
Sending IP: 203.177.117.142
From: sales05@rfvallianz.com
Subject: PURCHASE ORDER
Attachment: Purchase Order 38732.iso (contains "Purchase Order 38732.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38379/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.3318.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/408918
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256690 Sample: Purchase Order 38732.exe Startdate: 04/08/2020 Architecture: WINDOWS Score: 100 64 Found malware configuration 2->64 66 Sigma detected: Scheduled temp file as task from temp location 2->66 68 Yara detected AgentTesla 2->68 70 8 other signatures 2->70 7 bVrBv.exe 5 2->7         started        10 Purchase Order 38732.exe 7 2->10         started        13 bVrBv.exe 2->13         started        process3 file4 72 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->72 74 Machine Learning detection for dropped file 7->74 76 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->76 80 2 other signatures 7->80 15 bVrBv.exe 4 7->15         started        19 schtasks.exe 1 7->19         started        40 C:\Users\user\AppData\Roaming\akAFwl.exe, PE32 10->40 dropped 42 C:\Users\user\...\akAFwl.exe:Zone.Identifier, ASCII 10->42 dropped 44 C:\Users\user\AppData\Local\...\tmp21AE.tmp, XML 10->44 dropped 46 C:\Users\...\Purchase Order 38732.exe.log, ASCII 10->46 dropped 78 Injects a PE file into a foreign processes 10->78 21 Purchase Order 38732.exe 2 7 10->21         started        24 schtasks.exe 1 10->24         started        26 schtasks.exe 13->26         started        28 bVrBv.exe 13->28         started        signatures5 process6 dnsIp7 52 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->52 54 Tries to steal Mail credentials (via file access) 15->54 56 Tries to harvest and steal ftp login credentials 15->56 58 Tries to harvest and steal browser information (history, passwords, etc) 15->58 30 conhost.exe 19->30         started        48 smtp.privateemail.com 199.193.7.228, 49724, 49733, 587 NAMECHEAP-NETUS United States 21->48 50 192.168.2.1 unknown unknown 21->50 36 C:\Users\user\AppData\Roaming\...\bVrBv.exe, PE32 21->36 dropped 38 C:\Users\user\...\bVrBv.exe:Zone.Identifier, ASCII 21->38 dropped 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->60 62 Installs a global keyboard hook 21->62 32 conhost.exe 24->32         started        34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 09:06:08 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lrymp3p3p6q4s2y4lplgai3wrrt5efrhktt46dibffijf73gv7eq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3
AgentTesla
1b4e28dcbdc43bef452529271092f42190ea171e724dbf659622d170f6b7e080
AgentTesla
5523b6368db651832484529a46f8c4ce6661b4770e10081937b4014c97c2197a
AgentTesla
6ac8760908f2570c325974687806483fc02913c23a476a575362030f3926e2e5
AgentTesla
9023f7b2da3424f0542a1ccf961ad9a6f55c37351cf530e8811f9875bf3a6f8d
AgentTesla
c82a5ce771ee4c6afb7406184afba40c9aa6281c54cb9d6eeef5861d476cb3e9
AgentTesla
e83b98a736b614af8adb721b387d5eda8d794c6fd58296a59a86c6faf9baf4ba
AgentTesla
e90113ece868954185441f939e93cab4f887465291e620753b411d043131b793
AgentTesla
efa7f245a35c85568d26690f149f992e77c007fa1fbb7c2f4f050cea7fcca930
AgentTesla
ffc5491643c07ce077831156a0e1d74fbcf18f8826a8b78fd95dfa5282fc3e90
AgentTesla
+ 10'735 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer trojan spyware family:agenttesla persistence
Link:
https://tria.ge/reports/200804-8jqwfbktw2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Reads user/profile data of local email clients
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546

AgentTesla

Executable exe 5c70c7edfb7fa1c96b1c5bd66023768c67d2162754e7cf0d01295092ff66afc9

(this sample)

  
Dropped by
MD5 2bc8b26223deea9ce8106d1282f57079
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38379/
  
Dropped by
SHA256 1d1c22f475ef02f539b3dc4f10fe50b202903faa379e46bf076e36288db15546

Comments