MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e7fc09c2d5a1d17e9a3cdea27b5586b1ba72e1914539ba4ac626ceb4a768208. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e7fc09c2d5a1d17e9a3cdea27b5586b1ba72e1914539ba4ac626ceb4a768208
SHA3-384 hash: 1998bd750cda59901da00d02d59bed978ee9828d48d9be866fd5357ae608d5795b9041523f87ba313a6d9346f81bf5dc
SHA1 hash: 27c937596831f79650b571e4b130b5f00d00f0da
MD5 hash: 21105c98f29adcd918da296447638c87
humanhash: cardinal-social-whiskey-zulu
File name:NO098877665 doc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:887'808 bytes
First seen:2020-07-22 09:22:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e01edf6e44755e0328837b108f7966d (7 x AgentTesla, 5 x Loki, 3 x NanoCore)
ssdeep 12288:kQ/ena6F83r+bPrsdB0L0gazjJsJNulttShwmAl9WToLgeE0znizN1:naaFabDs7btHlttqwmwWkLgeE0zEN1
Threatray 11'305 similar samples on MalwareBazaar
TLSH A9159E66F2934833C563D93C8D5BA678982ABE115A197A476BF40F4C9F3E24338352D3
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: DS01199VM1.ds01199vm1.hosting24.com.au
Sending IP: 223.27.15.194
From: DHL Services Notification <donotreply@dhi-services.com>
Reply-To: DHL Services Notification <nurdan.ozirneks@gmail.com>
Subject: Luftfrachtbrief Dokument Versand gerade angekommen, jetzt lieferbereit.
Attachment: NO098877665 doc.7z (contains "NO098877665 doc.exe")

AgentTesla SMTP exfil server:
mail.legalcounselbd.com:587

AgentTesla SMTP exfil email address:
info@legalcounselbd.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31016/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.11988.27959.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun with Startup directory
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/394834
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7e7fc09c2d5a1d17e9a3cdea27b5586b1ba72e1914539ba4ac626ceb4a768208/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:24:09 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pz74bhbnliorp2ndzxvcpnkynmn2olqzcrjzxjfmmjwowstwqiea._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
21bbb34d06861d6eb75ca3baecf8b4eb8a04f5d4236285987cda14a656768577
AgentTesla
2522fc0ce2abffd595456b71ae2c01d8dfb4fa3597d2e0d2aba38d1ff3ee42d7
AgentTesla
254c1b8ff86ebe8a88aacb3172ea4c05289dc129d3364189bcdfd097e5f5ef6f
AgentTesla
3ddfcc0ce0a57e7f3131d0ba603d6516f00c6cf94f67e79ab38a7e8f922f74bc
AgentTesla
425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f
AgentTesla
554da92aa0dff594ff82094b0a8e8125419723e8899c670f7b8d74daf0580880
AgentTesla
723030fa9ed72506fdb6e625d49452bab33a214093a23d73b88fd981581ab1b6
AgentTesla
8948e4e0f392197b1c1436e5f7a2a7bc326c849b6129d8cf287a6d6a03cd642e
AgentTesla
a72cd506b5fc75c21d24703009cc3e58dbd7bb037bf8afaa9f1585ebc79ed235
AgentTesla
b4c84cf915c0f29a82c0fa8d9e7c7940338ebedf458ce7d4b187935bd5ba9e82
AgentTesla
+ 11'295 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200722-5njl2ncbhs/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Drops startup file
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e7fc09c2d5a1d17e9a3cdea27b5586b1ba72e1914539ba4ac626ceb4a768208

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z af3f1b5e078cfcd12a7ec23961ccf5a641f93c36d521284d4b850c13434cf42a

AgentTesla

Executable exe 7e7fc09c2d5a1d17e9a3cdea27b5586b1ba72e1914539ba4ac626ceb4a768208

(this sample)

  
Dropped by
MD5 d6803b56cb8c2f835ccbf9eda1ec136b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/31016/
  
Dropped by
SHA256 af3f1b5e078cfcd12a7ec23961ccf5a641f93c36d521284d4b850c13434cf42a

Comments