MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c94006b4e0347aa48450081134777310805b9f97dd417aae7874f5668d4b208. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c94006b4e0347aa48450081134777310805b9f97dd417aae7874f5668d4b208
SHA3-384 hash: 2d5bb46559e916e1efa7a651b2ca220dfe495a3cd1b70fb026ab50b57c28fcc4e03057b6e3021e126c919a5b3a14ddd5
SHA1 hash: 5219fc13e3ae7763f0b4519929ca38d00dc720d4
MD5 hash: 333f524377d04561a128139a8373bc32
humanhash: cat-north-happy-magazine
File name:TNT AWB TRACKING DETAILS.PDF.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:832'512 bytes
First seen:2020-04-30 12:24:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6ab296a1923cfab6fd94a91929b833db (5 x AgentTesla, 1 x NanoCore)
ssdeep 12288:TjG53a6Rb06OwOpcjur8zA5/ogsmQNSebGz95F58M/zYcJ9F63AuSLo3OvUq:uBhR4pcSrNQwQY7h5cCzJ9F63Dr3OvUq
Threatray 11'040 similar samples on MalwareBazaar
TLSH FD05BF62F1D17C37D1732A3C9D7B9264A83ABE103A38A8462BF41D4C5F397913639297
Reporter abuse_ch
Tags:AgentTesla bat TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtpq6.tb.mail.iss.as9143.net
Sending IP: 212.54.42.169
From: TNT OFFICE <e-invoice.gr@tnt.com>
Subject: TNT Express //Arrival Notice // AWB #700013580 30/04/2020
Attachment: TNT AWB TRACKING DETAILS.PDF.ace (contains "TNT AWB TRACKING DETAILS.PDF.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 10:21:41 UTC
File Type:
PE (Exe)
Extracted files:
39
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pskaa22oand2uscfacargr3xgeealopzpxkbpkxhq5hvm2guwiea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f
AgentTesla
4aeded46b92aeea959a9f7f8315dae9d9ddd3725cb6ff0a01df1820e11ebd2a2
AgentTesla
5255af098de7f7f6fa651b0e548cc647035161ad4d35478d943b4dd81de0caa3
AgentTesla
58e2c70cfbd44f3c9923c3b1e1e07e9a487c781374879b45121082c0173c2ed2
AgentTesla
6325a88a8d7fb027f3f0204848222bac306396e209de97fd86be259c49884b8c
AgentTesla
906f3fbf6a6face0d18f8e7d6b4f670df91f558cb9f4719fea860748f3964891
AgentTesla
97c65d84dfb5510cfbd1a11b4cf15610538c700cabbc0d25b24890ff9c9353d1
AgentTesla
aa556dde1f62e5e897bf5db6980f8202febe626f2e9840190f1f2695eec3c065
AgentTesla
c4c50cf3bc3e1096a29ec0c968224cd64a080a34322d2f7d27a75d2f992cd29d
AgentTesla
e386d4d99d65ec52f0a9d504a2e8fdfe92309a2a81e6dcfbf5037afc01a1e618
AgentTesla
+ 11'030 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 9d90ed7be85df7beb118307987d1417f5eba1dc9fdd11d57e0196000fba4b8cb

AgentTesla

Executable exe 7c94006b4e0347aa48450081134777310805b9f97dd417aae7874f5668d4b208

(this sample)

  
Dropped by
MD5 3ab3d787e28c191f63450f0b453053ed
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 9d90ed7be85df7beb118307987d1417f5eba1dc9fdd11d57e0196000fba4b8cb

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExA
shell32.dll::ShellExecuteA
shell32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments