MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a7ea4a20add0c6022d4e72fe7d7e5558230447a95e0fbaca75780c8f248a9c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a7ea4a20add0c6022d4e72fe7d7e5558230447a95e0fbaca75780c8f248a9c4
SHA3-384 hash: 28f7c3a9288302eb1310d781130b42b31b508b4ad73823206e9c1471965400fd385c8b41a56d4d6f6b5a37a26cc11711
SHA1 hash: ac1e852852ec7cd52f4f38e4a331b01043d7242d
MD5 hash: 26606620fa16a02820c21ebd8e114659
humanhash: river-sad-pennsylvania-kansas
File name:New Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:857'600 bytes
First seen:2020-04-27 13:56:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c0ad2c2ea9dc28bf0db406d9effa5ddd (3 x AgentTesla, 3 x FormBook, 3 x Loki)
ssdeep 12288:K0tjFefQXfJr2rr5unYAwGcHyMqdnFIIl075zvzdv/i2drNMPTV8/6lIBfKsA7J3:K4RXhAvAwGj/Xl0tz5XiJOqYCsA7f75X
Threatray 11'538 similar samples on MalwareBazaar
TLSH 8D05BF22F2E08877C1B21A3C9D1B97A8593ABD103D24DE4A3BE71F4C5F357913926297
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48024.3320.28593.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 13:06:29 UTC
File Type:
PE (Exe)
Extracted files:
93
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pj7kjiqk3uggaiwu44x6pv7fkwbdard2sxqpxlfhk6amr4sivhca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
157e2d59ee91293baecbd5c998e21a5fd380bccf67bdc9168da44f5d20aada95
AgentTesla
2302aa79bb34eb683a91324995a9fb366bbbe55dffb53deee00b842e75ad19c0
AgentTesla
310109e3b708c413160510f908f5ff048d7a0ad3645aca86cd86eba3a55fb017
AgentTesla
312ca2779ca2502a35fa0de2215e9ada5965a55896842f0c7d6742b8989d50f3
AgentTesla
48b595428b2e25e856d4fdd098da82bc1f00f6590318bd68120a61bf67f13cb1
AgentTesla
569b8cf6219a91161d48291f13285babe58b3be185623f3ec44c65c8369c2278
AgentTesla
77839da1c15d6390080afe07320af399a007d5b69bf4fcdf63fc71e795929cf7
AgentTesla
9feec7852ef1647fa53b548d5d55ae251bd5df7f112f22a63238612b6ffad1ea
AgentTesla
9ff973461fe556e748939d04aab5d5c8452cdb6350d52dbabefb347fc461ef5b
AgentTesla
f94788e7bfdc505f85854bc525b126c665f6cb1f16e674bbec097e44b98f949b
AgentTesla
+ 11'528 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ed04af177ad1d92cb185b111fc72caf2d35a0502c26a508d12bf9be20adbc5d5

AgentTesla

Executable exe 7a7ea4a20add0c6022d4e72fe7d7e5558230447a95e0fbaca75780c8f248a9c4

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 ed04af177ad1d92cb185b111fc72caf2d35a0502c26a508d12bf9be20adbc5d5

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediawinmm.dll::mciGetErrorStringA
winmm.dll::mciSendCommandA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryInfoKeyA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments