MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56
SHA3-384 hash: 899438222bf104bc9b7f9689f057a32598e52fd5fa025e6a210f2d2e08d6596258634cdaf34fde21756b8341414e9778
SHA1 hash: 8296d714801e158bd58403c7bec313037aeb25c8
MD5 hash: 983aad68a81d7136e4f55c39bdd8230e
humanhash: yellow-hot-seventeen-ceiling
File name:PO#19106UFIL11741 (#0014928).bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'784 bytes
First seen:2020-06-02 10:54:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ShCBJG2/CAmuEHShGaJ7Zklw8JrPt1qAdc29nODWmnMF6h38hGzOdpqEa:hBJZ6Axv6lxJrPtEkOjy
Threatray 10'653 similar samples on MalwareBazaar
TLSH 3CB4E09EB21472EFC857D472DF6A1C78AB50687B531B8103A41765ADDD4C88BCF282F2
Reporter abuse_ch
Tags:AgentTesla bat HostGator


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway21.websitewelcome.com
Sending IP: 192.185.45.140
From: kafafy@alutechs.com
Subject: Quotations - RFQ-PO#19106UFIL1174
Attachment: PO19106UFIL11741 0014928.rar (contains "PO#19106UFIL11741 (#0014928).bat")

AgentTesla SMTP exfil server:
mail.officelog.org:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 22:09:36 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wvrtegg5vy5utlwitasocazojatpxbie2onwjm634gzp6wotr5la._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
02312173c584901ef4cd183d407adbe6d39b2fad1b13681e12b00e4a814ab7c0
AgentTesla
10b2155331d3b0c7934808e52084c3911f82ece51f39836e3ef0e8db39ee9904
AgentTesla
38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba
AgentTesla
5a2965c63c2c74a0e8d06008ead3a82354dfd319468074823d5224a63e1a5c52
AgentTesla
60afae48613bb6cd966eadb913940af2f05fed3e132d19d48b941c7434365ff2
AgentTesla
706c201e12bde06af9252749e2c7959fc53fcda81ae5d68702238de5a004a639
AgentTesla
94b82f0655f1a9554b3cea8e31ac76ffd4cbcb32ebee539fb7706d4ced615fa7
AgentTesla
c94bbe19d634268f0794329f8c8a92cc9c1282a55f6a3de656858a4ed0fb80a0
AgentTesla
e738d23963c1001eb3cc3287fd96bacb4a4f073c665c866bc3cadf39d71350e8
AgentTesla
f242ad8f253e4e481529cffa7b3d697683649ba31b8c8500f2d24d2bf591e553
AgentTesla
+ 10'643 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity keylogger persistence rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-h6p3zkdjt6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1d2254e0b55892097e48816d4026a94a1a07230bd77c0b4f74186917f182d3c3

AgentTesla

Executable exe b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56

(this sample)

  
Dropped by
MD5 dc7e6c00849aeecda84d5187d2d43b0b
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 1d2254e0b55892097e48816d4026a94a1a07230bd77c0b4f74186917f182d3c3

Comments