MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad3ed5a2a7fdaf7778464c1f3bd3de13972d04e7123522cb906ea18112e359ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad3ed5a2a7fdaf7778464c1f3bd3de13972d04e7123522cb906ea18112e359ba
SHA3-384 hash: a314c98f664247b054a5091198f297b5e08198819b6ac9fce3ccbaed416f5e9faffd737a6162824d76b30ae33409d8dd
SHA1 hash: 29a2f5f8108d335f46cc8a9dbb9bee1f890a264d
MD5 hash: 71209afc9caa22606e11c0da82778c39
humanhash: iowa-fix-nebraska-social
File name:Purchase_Order_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:861'184 bytes
First seen:2020-03-26 06:03:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:yAHnh+eWsN3skA4RV1Hom2KXMmHajB25:1h+ZkldoPK8YajK
Threatray 11'058 similar samples on MalwareBazaar
TLSH BA057B02B3D1D036FFAB92739B6AB20556BD7D250133852F13982DB9BD701B1263E663
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 03:35:00 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
24 of 30 (80.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vu7nlivh7wxxo6cgjqptxu66cols2bhhci2sfs4qn2qycexdlg5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
208a8cfdd915e43d58459d4e082efbbf58c649933c09c18c52bc95d34f9725ce
AgentTesla
33eff9415626bfe8ec4229ef6a6b248e0e6b7b1115c84a78724dd9b58336bb28
AgentTesla
342c79ff62a16ad618c837f19efa7362a7f06403b5eb405ca667048d90344945
AgentTesla
4f1d9a967da00fdf547491027d2a3d1fc60cd6b3ad216786505c1405e7a07f08
AgentTesla
8ed35bcb3d309f150224f3feb4261974ce96d19c908ba0467c2a2a1a397fba1e
AgentTesla
970ffc480d61b37737f34ddf738e257a99162cce8338f7c59fdd4ab995ae9dfc
AgentTesla
aad3b8a87d1932384a6d1c2869b9138ce79d78b3bfc2cd61324e1a833f5f967a
AgentTesla
aae45a77eeaca2d69630e035293e25a47f81d5b7612bace059d1678154485b85
AgentTesla
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
AgentTesla
f834e2059da963db70d88af267f09807a69fb3edfaefc344e5ab542911835be3
AgentTesla
+ 11'048 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 2d338755da4dcd93e5072239b03eba9102aa75a96be5f587b70e3283d10739e3

AgentTesla

Executable exe ad3ed5a2a7fdaf7778464c1f3bd3de13972d04e7123522cb906ea18112e359ba

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 2d338755da4dcd93e5072239b03eba9102aa75a96be5f587b70e3283d10739e3

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments