MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a21c8651404d572a8074ffe3fbe15aadf04f2a85d57333dae44f253a7c0a5e03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a21c8651404d572a8074ffe3fbe15aadf04f2a85d57333dae44f253a7c0a5e03
SHA3-384 hash: 369ec2ba6a6821195e1560a2a476aa777e4a373626f2e02d2d90bfcae7fd89e7eb12c9e7631dac38ae82fa3f479117bd
SHA1 hash: 0be37a2546a759b2231dc75622d58c3f8eef2b98
MD5 hash: ca68d747c741dd5ab35eff7e1e794da3
humanhash: bluebird-angel-hotel-november
File name:285100727000782928_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:788'480 bytes
First seen:2020-05-01 12:28:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f52f1f062ba3dfd93d9913368e901b1 (5 x AgentTesla, 4 x Loki, 1 x NanoCore)
ssdeep 12288:T7wsA2hKOCdcqGjavPNe1SZ1xbv6sNiJbnUH73lROgRGzCUHxkXN+j5s:H7A2wpdcqwkcIpNebOlogRkdINt
Threatray 11'283 similar samples on MalwareBazaar
TLSH 18F4B032B1E15C73C3672A7C9D0F6768AD2ABE102A6864866FF51C4C5F39391382D1B7
Reporter abuse_ch
Tags:AgentTesla exe geo HRV


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server4.justsee.co.in
Sending IP: 180.179.34.100
From: Sberbank <izvodi@mail.sberbank.rs>
Subject: Mesečni izvod za kreditnu karticu
Attachment: 285100727000782928_PDF.zip (contains "285100727000782928_PDF.exe")

AgentTesla SMTP exfil server:
mail.acroative.com:587

AgentTesla SMTP exfil email address:
jn@acroative.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7744093-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Injector.ELSC.32193.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 12:39:17 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uioimukajvlsvadu77r7xyk2vxye6kuf2vzthwxej4stu7aklybq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
0be2fd26cdd52bc071b076fc7350077db4962173366192cbc9870df8b3cb234c
AgentTesla
1c2bc3fe39eadb67c0a9712e29ea2f2daa523eb3440606a0348827c3f84daeda
AgentTesla
1d5d33d83029cd0b64bd4171db3e6535c4f50d31cc585b6e2b10345121c346fc
AgentTesla
1e16abfda8f084403f909b32b0998fd41e43b44a7fa0733e080399cf7a77d3c7
AgentTesla
33080a9c91a75fd27eba463264265ddaa6f12055b0fa062021d505f70f204814
AgentTesla
4ec6d85f82f9d0874d740c3fa5b94c800e25b5dcd05b63135f6da92a8644d70e
AgentTesla
6d2ee028b29ebd24c1e3fe0cda4707ff2d4050b3eac335de77c560bee46a678b
AgentTesla
b81ce07ddc4e67ba7d1f5d1b6893e50eb2c2e0f4a7c5ce3dce1971eec3e6c999
AgentTesla
ba3bac695a448759f82d4c5180cad7d308fdb8bc12a159456b75ead72aca9424
AgentTesla
f37e150f7ac1a5fbd8541b51f7b42951d4858caafcd29ee15d48020d58035efa
AgentTesla
+ 11'273 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b05b05f35abad8b7286cd6b0e6ce6912fe9519bfcf7524b4759edbf4b697c240

AgentTesla

Executable exe a21c8651404d572a8074ffe3fbe15aadf04f2a85d57333dae44f253a7c0a5e03

(this sample)

  
Dropped by
MD5 d18a548409408e2fc855b8e9c2a4e36d
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b05b05f35abad8b7286cd6b0e6ce6912fe9519bfcf7524b4759edbf4b697c240

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetDriveTypeA
kernel32.dll::GetVolumeInformationA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowA
user32.dll::OpenClipboard
user32.dll::PeekMessageA

Comments