MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f
SHA3-384 hash: e47400a4a6b10a23205cffa891d695c2cc7c5608eeae99982b4c9a8fc7c0416b408168ac98ad964f2e6d4c089070ee1c
SHA1 hash: 79c51845c1f9fffc0f7de00e64b546d261b41513
MD5 hash: 47872ab0dfc30acca8a4c9dd7e143eca
humanhash: florida-massachusetts-massachusetts-mountain
File name:Inquiry Order June 29.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:484'864 bytes
First seen:2020-06-29 17:56:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:qd5phqR69n/4MGlGFRm9534Fhf1KxiC5joyfpbaCX2:qd/GKwMGyc/Kt1dC5jDp
Threatray 10'630 similar samples on MalwareBazaar
TLSH 84A4011032DCAB26D9BD83F988F4599407F5B5EE2613F31DAEC160CA1A66F900B51E27
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtpbgeu2.qq.com
Sending IP: 18.194.254.142
From: Harden <harden@braidedhose.org>
Subject: AW: AW: Inquiry Order Spec
Attachment: Inquiry Order June 29.rar (contains "Inquiry Order June 29.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/16538/
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 15:11:03 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lzkbl7tu3le4yd37fpcfyn32bdcdb2wfn4i6zt7ktfdolhvgenpq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
11798aa5516a8f71c584946859498678274b20ad961bfabe8d65049457915c5d
AgentTesla
151fd7b3871f007957de4aa59048b9a25a68784f0d7e4e77e9ee6f26f1256702
AgentTesla
1529cc99d5896fcefea1802d4633d78f86e3184add5d7e451ea4f437bd451b17
AgentTesla
2bff0b840707457db9933a7ec8657216c9321fb18d9515371a9fabca227aabe7
AgentTesla
634b35f814ecb44977e2e9f0e34d83ad96d336ccc87bdecf703f1e0c44a2c69c
AgentTesla
a08005202c9ef8e303347f938d73e2bcc58548a5b8904f9d242f31d7b868b725
AgentTesla
a2afda47f4169023bca3c730a48e58d6c40e84236b959a871e883ded3304d5fb
AgentTesla
ac14d182546457a8a75ccd5ed95a06f4d3983cd375bfb5fdc8615e2ebe3837f6
AgentTesla
bf2f666cc2bf3dff6a34835ddd2b78a8cf6a6cfc2a725e81226996010669ed2b
AgentTesla
f18c54f75aac4793d30118e30aade5bbc01deabe6e0c75ac01529702f4a9e9d8
AgentTesla
+ 10'620 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla persistence
Link:
https://tria.ge/reports/200629-cxksq8bkna/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of SetThreadContext
Modifies service
Reads user/profile data of local email clients
Reads data files stored by FTP clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 50eba9b8e7e7084e50a489c7082e628b1e9e3081c2bb3987aa5e4552c23ed499

AgentTesla

Executable exe 5e5415fe74dac9cc0f7f2bc45c377a08c430eac56f11eccfea9946e59ea6235f

(this sample)

  
Dropped by
MD5 13912a6798290eb06aefeae32be9e32b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/16538/
  
Dropped by
SHA256 50eba9b8e7e7084e50a489c7082e628b1e9e3081c2bb3987aa5e4552c23ed499

Comments