MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d
SHA3-384 hash: b6a48feeaddb0202eed570ff5ba9fce96cbea02b6bdb85d263c9527b6d5eb46c296b7b0742975efc01262b8e0a368b4b
SHA1 hash: 726effacd1070764db731f93dbb9f4f4b0320231
MD5 hash: cb1e5100178e01e87e62c31c97b95f1e
humanhash: blue-maryland-illinois-florida
File name:New Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:720'384 bytes
First seen:2020-07-16 00:56:40 UTC
Last seen:2020-07-16 01:41:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:r5kRlKFk04/10hD94tBWBtSuS0b4xY1a2EtKH4ROsU0pkukUkLfq7EG:CSWT2D98gIyo5yYMoJiy
Threatray 49 similar samples on MalwareBazaar
TLSH 32E44B3C3A816801D93D067644A959D0ABB1E5CB6B12C70F7AC6076C9F13BEB3F4619E
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26285/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.368.8109.16872.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Launching a process
Creating a file
Launching a service
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-15 11:47:15 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdhltz2vxlaq43ov6jjnmf2ocllj6j2jlyt4b7frma2bpadse5wq._file
Verdict:
unknown
Similar samples:
060c1d915b9c3c7b1bc2b2f3f7e87bc6149efb2b44467f3e0a4456dec722eaa7
AgentTesla
1c6c9635f0c01cc93b504293351215058cf9ef8b62ca38ce71012a4875fbe0a4
AgentTesla
6ef5fce9946da4cd9e356713d79b22f4615c7447eb4b3861d46bb816c97b88ee
AgentTesla
7e0b697ca060ceb919fa17715a88ffe9cf8ad66e3e95a720400f27777fbed132
AgentTesla
8e18f7d57532e145224c23b3bdbdfcc04cb394e0e3506bccef49eed06f3d2e10
AgentTesla
918973702e97922d932c32d86618ebd35116fb2d67a93cafd0f53a5b7b30da29
AgentTesla
a96a96a53fa6c86c3a3b898caf9b5146409680cc926b1f73c5bf4fe80bf90cdb
AgentTesla
b01d0e871f96ddcf4df2358b7a452c488d628829d14d5ede0a58243cdd1dbdc7
AgentTesla
de006c9526937934142c1f991be7b89fe9d9fd6c080bc340e8fc542e850fd4f4
AgentTesla
ee987a88ac7966c91dfde419e7389236d138129a828d6819acb6c211b8954b3c
AgentTesla
+ 39 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200716-2ydkvznsf6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Malware family:
AgentTesla.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a8ceb9e755ba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 7185fbf066953920bae009a5e52456c42b011aeb0bff18daddd8cca2d62665e7

AgentTesla

Executable exe a8ceb9e755bac10e6dd5f252d6174e12d69f27495e27c0fcb16034178072276d

(this sample)

  
Dropped by
MD5 863e8bff1352f98fed1bfa4e4ff83a66
  
Dropped by
SHA256 7185fbf066953920bae009a5e52456c42b011aeb0bff18daddd8cca2d62665e7
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/26285/

Comments