MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a5cbb1ca35c85dd0ce45ba9b432173991d58f93e04b802ad7e0bc591dbb22fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a5cbb1ca35c85dd0ce45ba9b432173991d58f93e04b802ad7e0bc591dbb22fd
SHA3-384 hash: 010bf61f4619588a078ac3a3db0dad1f2a3b70237bebd75b0ab2d9b2369dae07e172a4bf6dce4a654c468182b98d4a67
SHA1 hash: da8acb5cbdf00b5ba2f889c2940670d4556925e4
MD5 hash: dc39e8eb55bf2fd7d99df590dae093a8
humanhash: chicken-potato-happy-papa
File name:SURRENDER BILL OF LADING - SHIPPING DOCUMENTS FOR Q2 AND Q1 PURCHASE ORDER.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'519'104 bytes
First seen:2020-06-10 12:07:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaBA6fR/dsNVoMNl74c6O9NYBuE/5:Fh+ZkldoPK8YaBA6zQl7k8I
Threatray 11'263 similar samples on MalwareBazaar
TLSH F365C09273C0C035FEA792738B36F253567A791D4837851F26943E6ABC713A2123E663
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 12:08:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjolwhfdlsc52dhelou3imqxhgi5ld4t4bfyakwx4c6fshn3el6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0803c7f9b60e8a3735b5d5f222b94c1a74290f4dc9eae4fd1e0b65e3ffa9984b
AgentTesla
18fc7b8025209d438de81fc74e7dd95699b7a66106b891a32fb375f21ceeea1a
AgentTesla
1c4730818d3886e62b2708fd726dcc11749cff7be95485d414b9e280ea6589f0
AgentTesla
415dde31bb66f5a6fa3b7ec84d5c1c33c4c6c7038e897dee5b562d8ce70246a9
AgentTesla
5075acc6c08d15588885a22a704f971b17e0714b81483889124dfec77577eb5e
AgentTesla
58bad158a27f9a034e8f9c5550a82d3e26bee314a33662a51074d3cd1dff1ccc
AgentTesla
7127bd5267af450e0d9bd47a6b1e84add8dd1a0d44c93873ae4a19464696ace5
AgentTesla
e4408c38f727c9fb7a0b7247f293c8634c17eecf28897369c764d64495d5f0d4
AgentTesla
ec7341298210fae2e147d0ed6b9f9cf9edfd87d7e3901083ac4ab7c7d98519ba
AgentTesla
f7e555dc8722f5298513531239e35e2c77ae86024901a73fdd541a7b50961ac3
AgentTesla
+ 11'253 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-ffz3zwysy6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fd7c32b239e196017fca22ed58b84c22a00deb70bfc8599c48bce4d706d126b9

AgentTesla

Executable exe 7a5cbb1ca35c85dd0ce45ba9b432173991d58f93e04b802ad7e0bc591dbb22fd

(this sample)

  
Dropped by
MD5 bfa21dd12662303b175f1587e1926e94
  
Dropped by
SHA256 fd7c32b239e196017fca22ed58b84c22a00deb70bfc8599c48bce4d706d126b9
  
Delivery method
Distributed via e-mail attachment

Comments