MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3
SHA3-384 hash: 4c89bb8740035f2b3e97ce3398ed1c5bb30fe94dedd6150a6da40e3f3b5a558afadd645eadfb97a194ea735e23037bfd
SHA1 hash: ddfa4f193990f5304565c704200f8e3e0517add1
MD5 hash: 1c5110e0f33a33f00cb93f1740e712e0
humanhash: jersey-twenty-alanine-salami
File name:POL 186 22-06-2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:443'392 bytes
First seen:2020-06-22 07:47:52 UTC
Last seen:2020-06-22 12:19:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:v7DmJc/VcnCShQRjBSp5LrP3g1DhJAGde7g9XPWBnSnNjpkaFB4q:vAhQRjBSjrPMDDne7gdDNjpkaw
Threatray 10'789 similar samples on MalwareBazaar
TLSH 4F94E0543FA8570EE26A57BE1821621D17323BF58A52D2CC18B7FC9D5E26F03428DA73
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Aya Zaidan <arifur@ucbdl.com>
Subject: NEW ORDER 22-06-2020
Attachment: POrderL 186 22-06-2020.arj (contains "POL 186 22-06-2020.exe")

AgentTesla SMTP exfil server:
sg2plcpnl0180.prod.sin2.secureserver.net:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12470/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.4917.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 07:49:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyac4hsmea4fghqktgh2haf2palnzqvoq4xy3akc34hrdtadgdbq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b
AgentTesla
1fe9e9760604fed048445b3c79c91d30a9b1cf75a2a689c48181724a91df38e3
AgentTesla
2eebb01bf1beb78cf343f5465a600eaf0c17af2bd28a7133d41581e8fa2ee5a4
AgentTesla
41f79628a7ff72d611f593286f5b70a51c72f8359e6600535b1b3e9772fd7c0c
AgentTesla
5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350
AgentTesla
6cb654eef04d1ee111df21c38103ff082fe9e035e46c036ebecc0bc21d3efd80
AgentTesla
798676352c75523109a4cd08f282ae658bdde5ba1e77b45d19c8fee68115d3df
AgentTesla
b8816e0b814bc0528b84fe7e0e89cf5e8168b64a8028d8610510a59f3f7c2268
AgentTesla
bb398328320c76f194dc38b13275c4fe564cd0c85457fc83e62643110cfe0631
AgentTesla
e8454346c57024c395766f6c82771a58c6f03cbaa15871646cc197aae5b73461
AgentTesla
+ 10'779 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-e1caffkj5j/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 653291c6b6c83548cae8a81eca2cf250f476e5a66105767147ce96d4b5598d9a

AgentTesla

Executable exe 5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3

(this sample)

  
Dropped by
MD5 5832e6d3f4ecc33b9da3487c898a4d63
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 653291c6b6c83548cae8a81eca2cf250f476e5a66105767147ce96d4b5598d9a
Cape
Cape
https://www.capesandbox.com/analysis/12470/

Comments