MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086
SHA3-384 hash: 31a0bfc25aa4d7b47da5e6cf5d8a9b4baff1472079070ca3f758da8b0d29e01b8b7d2ec43102107158e133de5038343e
SHA1 hash: ef9e80e60b5fdc06202c5d63bdef1de039d57c94
MD5 hash: 5a660770d48cf223a26ddfc3efc7155c
humanhash: utah-six-yankee-whiskey
File name:URGENT ORDER 03082020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'584 bytes
First seen:2020-08-04 07:02:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:u3WY6KW/8Hw3gjL91K7otXqHb9vUuW1hGvw6et8:+R6B8HwAxXe9vUEvw6f
Threatray 11'311 similar samples on MalwareBazaar
TLSH 63A4E07B13570F07E36E68B9C0E2464112FD8C756062E6A7FE843DAD3EC2BE44751A4A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.outgoing.loopia.se
Sending IP: 93.188.3.38
From: Ċ½elvoz Smederevo <nabavka@zelvoz.rs>
Subject: *TOP URGENT* NEW ORDER
Attachment: URGENT ORDER 03082020.gz (contains "URGENT ORDER 03082020.exe")

AgentTesla SMTP exfil server:
smtp.wtgriderline.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/38248/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/408743
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 00:31:08 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdjdlooardu2movogdn2olvyq23lbdxyuzsntf4zipo7u3ae4cda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
097ef15c4b39a5c768934359f140c3f41e9fd8cfc00c32edf54c96ae72417ed0
AgentTesla
261d9ecea1cd1ff4247b59e2d8f2d8ba4484811be97c1cad06f236dadf494139
AgentTesla
34e851e30200d924177f7d916452342a87df1388830625bd3e43510ce4136af5
AgentTesla
56469fde7730da15f61f83e5aa2370cbe0adabc5d7487bf471fa16ee952d9237
AgentTesla
7286dbc96aa47a9212fe0c1ef671ae256560fac8735a6ccc068f34d890bd24f9
AgentTesla
897a1305d267937baedeaf75e35e386efbb9c5d7d66819aaecfd885e84196142
AgentTesla
920793d133d7ad17ee4d14870e23dfba742ecd19e45a8a0c3e1105605b71cc8e
AgentTesla
bd3217085dc8bc107e2b4937e89fee521d0f1489e35bbdbc0ee1e8be241f1773
AgentTesla
c465ef4e04ed7cd32d3dc6cc3e52ca654721fdfd696baa7d6358e72f75a4b55e
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
+ 11'301 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200804-1nckr5vds6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3

AgentTesla

Executable exe b0d235b9c088e9a63aae30dba72eb886b6b08ef8a664d9979943ddfa6c04e086

(this sample)

  
Dropped by
MD5 113190230355ecebef6b5cf1a0106293
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38248/
  
Dropped by
SHA256 0bb6834c6a8ec460fd2606bcb31845e7d8e9fc805e496d20bad7e3ece43bbcd3

Comments