MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6643781dac29ea8cc9178ad8213a8e0b1fdee342cafaa1d386d1b8621297e4ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6643781dac29ea8cc9178ad8213a8e0b1fdee342cafaa1d386d1b8621297e4ba
SHA3-384 hash: a9eab407216ad54717805d4a261b7f51d64e7ea2e3f8248741a17ae45b2f99b2696deecd21da4499b0621e9d9e927907
SHA1 hash: bd52d942b6239fba05b2a38f4c471fa95de8bd42
MD5 hash: 2b7f9ebfb8e57882198b4215b7bee93d
humanhash: oklahoma-batman-carpet-green
File name:ORDER - 598 TO 602 FRUTCO AG TRADING New order 2x40FCL.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'376 bytes
First seen:2020-07-05 07:07:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:B6Y2iNWA0yoYY+nzpegp7EqbIP1Dy2EGsTyvZE:b1Y+degp7In7sGZE
Threatray 1'625 similar samples on MalwareBazaar
TLSH 77C46B5173F19433EC8B0175602837C82D7CB943B2D9E25B9B377590A2629FBF6A4E42
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/20546/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6643781dac29ea8cc9178ad8213a8e0b1fdee342cafaa1d386d1b8621297e4ba/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 16:46:36 UTC
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzbxqhnmfhvizsixrlmccouobmp55y2czl5kdu4g2g4geeux4s5a._file
Verdict:
unknown
Similar samples:
2f6a6d53e0ea3b6314279e5990a77c0acd90791f677086bf0a1b40fa48917222
AgentTesla
3be937bd3615e1178d145560c18a2dc17c6301de53bbf16b64aeedf1d6bf0d9a
AgentTesla
3bf2467d7e7031b0af1fccfbc9d67fc29b572aaa64b1df6a77eed00cee768a04
AgentTesla
48ce0e9cc96cb8d9ebe92bd7c1982e84d48baffdbada44d5949370a58ebae901
AgentTesla
8580ff35d1a889f09687a1c1ea963f17974fa38b7db5117a97b88e2ff5c4f79f
AgentTesla
91236da59c95dd764f85a84297238f215ef0cd3d0fbc37f2a2f15d2f302e2dfd
AgentTesla
922d69b91fbe84aaf3f6fae8eb416ce48f8106e6cb5ec60846409beb029b235b
AgentTesla
c4031838bc163076ff2845546cad4c409d9cec8a2100d78d4ea1ea75579f7c37
AgentTesla
c6dc66a444215d6221e09e8fd68ae3a28eacf55f8de8462fb975c235304d7c4b
AgentTesla
d76bb689a401094eee47a075368224161d261665c2b285b155d1b7833ba4fbaa
AgentTesla
+ 1'615 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200705-748dhvnbej/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 6643781dac29ea8cc9178ad8213a8e0b1fdee342cafaa1d386d1b8621297e4ba

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/20546/

Comments