MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91aec1cffe5f0160137ab5d98b28a1c381465abbb7ad8c2c1c8dd6df05345e34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91aec1cffe5f0160137ab5d98b28a1c381465abbb7ad8c2c1c8dd6df05345e34
SHA3-384 hash: d44e47876053260c7e608cc62a92c2aee901e572c3860c0e57529f8cb5678f57122bfce34676ed852d726daf24e6523f
SHA1 hash: ada458c5d249323f9e93eb011a353a47a6663509
MD5 hash: 474b9df0f2789b0e0b8e88d0106a449c
humanhash: washington-shade-nineteen-seventeen
File name:Payment Slip1.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:781'824 bytes
First seen:2020-08-10 12:48:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ce9dc34dcdc6dcac1abc92d3ec049de7 (11 x AgentTesla, 4 x MassLogger, 2 x FormBook)
ssdeep 12288:MQoTCHdOasekxlSBWq6UDb9BxgMBFGCeR7HT70+VD2gIkj:Z4UOaeCWal93GVRLEruj
Threatray 11'757 similar samples on MalwareBazaar
TLSH 79F4AF26E2E04837C367DA3F9C1B5667982ABE513E2469452BE45C4C4F397B03C252BF
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.bgesoaeg.ml
Sending IP: 5.8.93.45
From: Accounts <candy@bgesoaeg.ml>
Subject: Receipt of Payment
Attachment: Payment Slip1.rar (contains "Payment Slip1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42768/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Adware.Kraddare.1524.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/416915
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Potential time zone aware malware
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/91aec1cffe5f0160137ab5d98b28a1c381465abbb7ad8c2c1c8dd6df05345e34/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 12:50:11 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sgxmdt76l4awae32wxmywkfbyoaumwv3w6wyyla4rxln6bjuly2a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
13c555d2bc29bc384b7c496c0aefadfbe38d7b415e11c43bdbcfdf702062d1f3
AgentTesla
1a8d85a16bcc49b33c11489af823ff2f15caa31ecb616330bb54a4ca5b261769
AgentTesla
298e36ccbf66428cba5cf385f3bb33d4c807aa707ff06d66869e7d584b3e5287
AgentTesla
31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa
AgentTesla
6cf454ec0892e0367356ae674e93612f1c23d9c99874d8ff7de7d77055cbf9c6
AgentTesla
7ab75859697472c8bda10b6cb7e7ffa7c8f5ce5eae3e7c67a565ffad2c6de83b
AgentTesla
903d75d1676e90dbe26dfd79c6fa865dc2e53a40e3190b4dd76b260ad608b555
AgentTesla
a6df90a24c8100b2ce198b1d3aee1f5bc78d6ab846911a58a0183f4c72912217
AgentTesla
a9abad7f4aace35de5651f437a83f47787606345d04ea63426db6a7a9b02ba5e
AgentTesla
b1de8cf2d588ceb071c2549d61bec4724abffc886a42042268fdbfa9215a774b
AgentTesla
+ 11'747 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200810-yrsc6ajden/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91aec1cffe5f0160137ab5d98b28a1c381465abbb7ad8c2c1c8dd6df05345e34

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 942663f5ac9054490e0fba876ca5ade56d7c4969aa5368f0aa88e247c55e36a3

AgentTesla

Executable exe 91aec1cffe5f0160137ab5d98b28a1c381465abbb7ad8c2c1c8dd6df05345e34

(this sample)

  
Dropped by
MD5 b21e1ec82bfc8b16bc8d168fa4ef7768
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42768/
  
Dropped by
SHA256 942663f5ac9054490e0fba876ca5ade56d7c4969aa5368f0aa88e247c55e36a3

Comments