MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90
SHA3-384 hash: 565668c1c88242634f69438f213d3d447ab4eb1632e29c2bfef00fffa622f24a3e1b3e7ec41074e9904b394d62beea17
SHA1 hash: a2879c30d6ec2ba9531018e4ed61a411aba66857
MD5 hash: 42133af0845add0288dfa643f83e4097
humanhash: eleven-mango-july-chicken
File name:Payment Advice Copy.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'762'304 bytes
First seen:2020-05-11 12:44:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:iZqfCck3cwaX0il3QMHW5QYaEqNf+FPan6SYnOYbuNSDAnnyLgjRO85y6qn6KNoP:iqY0fKPanfTNS0nny8jRO+y666IomO
Threatray 518 similar samples on MalwareBazaar
TLSH 6885125036AD5766E4F99BF52EA8E062D3B1B8577994F76C4CC268C606E4F40CC30E2B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.javedgroup.xyz
Sending IP: 138.68.249.252
From: Mohammed Shoukat <Mohammed.Shoukat@saudifilter.com>
Subject: Urgent Confirmation for Payment C/I No.: BK200316-1 by Advance\x0a Payment
Attachment: Payment Advice Copy.r09 (contains "Payment Advice Copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.10384.3584.10207.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:36:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pytkz2ench7ue4fu37gxgkpf5piqacwl4tpbuxpbvzgaeppgnsia._file
Verdict:
malicious
Similar samples:
002aef8a86bf6b84b51b2397f5fde91fa679e53e74d04165d1476f81d9c3fb40
AgentTesla
40eac0b9c7fb03c9f4a54a82b47534babfdcc931b5d83832f1ae2facd9fe0cc3
AgentTesla
8a3dd3eb355760a77c7bd89e2316c7741e37f9b20435a23d144e58ba856bd7c7
AgentTesla
a412b9a89e53822798a37e00efb760bf4556140d0c1088b440aaa57f10869603
AgentTesla
a97835df055504850909bdb785d2bd535cc22702f418147cc3af6d4add370a59
AgentTesla
ca946b7be994d2636254cb8b8cf44f5b7aa57fd705c6e07119aa4e68092daa01
AgentTesla
cb8c9572b8c0299b05a17084ae5dd93d0aea243138bfd03eaafaee950390724d
AgentTesla
d2aba15a355f2587296a0d3de5416fe3ad7a644aaf39e9b8c5be0125a346abc6
AgentTesla
f058f245d06f4d059132d2b9e90f84a332d0471ff0c421d49ca828d76874b8f3
AgentTesla
fe3dcdbbb57d61e04df490402d1e477ec1a804add945a2287c697b18a2234227
AgentTesla
+ 508 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity rezer0 spyware stealer upx
Link:
https://tria.ge/reports/201109-csjfzjp5qe/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6

AgentTesla

Executable exe 7e26ace88d11ff4270b4dfcd7329e5ebd1000acbe4de1a5de1ae4c023de66c90

(this sample)

  
Dropped by
MD5 66ad80f8660d2ca9716a3cdc8f53d1d5
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 139685166623757886e856232304c42d1f28af11b43498ffbd4c43f45da4fcc6

Comments