MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d
SHA3-384 hash: 9cdfec97c48c68da3828e321a812f339889724f938a4d5bd46ede47703cc17909d9fcd56e624db738765c1b61bb2c2e9
SHA1 hash: 6f5eb29141bd96d2efc312315c3d181a1a42e72c
MD5 hash: e485beb2bd8d7b87fae26065cb2f1951
humanhash: uniform-spaghetti-pip-december
File name:IMG-67890987654456787656789876-76567.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'056 bytes
First seen:2020-08-10 11:42:19 UTC
Last seen:2020-08-10 13:14:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3b28bc2fec3f9767d3053e9ea8d34393 (3 x AgentTesla)
ssdeep 6144:idZbZeAPuQIvFRVfONEV9rdpEHXHKpFRqQzN0QzRd95dJzk0mVkEmiSmqhFm:iztRIvF/L9JpMKToQzNXd957zSVZmvy
Threatray 10'662 similar samples on MalwareBazaar
TLSH 6694E0568B458080E4E701F77279E6621E00FD74B4B89987FBD87EA3B531ECA9416B0F
Reporter abuse_ch
Tags:AgentTesla ESP exe geo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server5.magi.net
Sending IP: 192.243.105.163
From: cuentas <cuentas@aluwheelmx.com>
Subject: Re: Confirmación de aviso de pago
Attachment: IMG-67890987654456787656789876-76567.gz (contains "IMG-67890987654456787656789876-76567.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/42738/
Detection(s):
SecuriteInfo.com.BScope.TrojanPSW.MSIL.Agensla.10813.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Sending a UDP request
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/416821
Signature
Allocates memory in foreign processes
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 11:44:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtk2mw2o4mrozqvougkaxrt5hebh25q6nvxtdc5jmszmgmgn5soq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1aa7a26dc92fbd8b4bb9ddd986a7160525ed218434d15d7bfc13e8b4dc5a7275
AgentTesla
4163f850032d58f8df3a47be1173ff7ff5d89c989512bd08979e724261994345
AgentTesla
5a023b9d4e63aab62c95820c69b08fc286f1ff99f7eb9381c5a83b258784063f
AgentTesla
67147087feb1efc01a641bda1a605bf30457f1cbc8b0143aa997b3bd323e66b8
AgentTesla
902924b52c5bb0479fecdd9802b067aaa25f1cf89ac97c91abe6cbe59a2ba21c
AgentTesla
91c8f2961875cc9e46f40ea917b6d83c45301926d88bb8a0af857f3caedcf8bc
AgentTesla
923d7900589564387968fb04fd33fd8b4f5175d39f938469a54fb8190eacc795
AgentTesla
bff2f1623b2ab128f79406b793b67413ba0fa8bf2e0cb90c75bf23deea814856
AgentTesla
e72bbdfcc56339eb2aca00e01162d7fdd1004d9992150f2dea1b014d6b4469ac
AgentTesla
fcdececb42372d5ae1a1a1d367046476f916624878980498984983f00add62ad
AgentTesla
+ 10'652 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200810-gv3j5pbc86/
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Reads data files stored by FTP clients
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3

AgentTesla

Executable exe acd5a65b4ee322ecc2aea1940bc67d39027d761e6d6f318ba964b2c330cdec9d

(this sample)

  
Dropped by
MD5 a5ac2894bc7fef32be453553e64e9b9d
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42738/
  
Dropped by
SHA256 9fd950fe94db9d33f8e5013c5021254f7faa5d3dc0226c297487e1a92f4a7be3

Comments