MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c53185f575195f3621b1b2cd4f8e95f60098dd6340c8492a90fb1c0d880ee7a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c53185f575195f3621b1b2cd4f8e95f60098dd6340c8492a90fb1c0d880ee7a0
SHA3-384 hash: 3d5e30485db1d0ee56125501f6516e7c7bcf5551f0333baa58f7e24a415bbedf1b8cd4477b29fb4a78c3b70ad65149ed
SHA1 hash: 743370819af30e4e5c964cc971618755b149d190
MD5 hash: 0261d5bb834ea34ea194b7cf3c738737
humanhash: maine-fourteen-sodium-robin
File name:Order 88633.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'576 bytes
First seen:2020-07-28 14:19:21 UTC
Last seen:2020-07-28 15:01:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c458ff2d515beb8f44158cd3636a7400 (19 x AgentTesla, 6 x NetWire, 3 x HawkEye)
ssdeep 6144:kC7stzY5vxP51fIlAtyNH1J5aYE3jzkVIRPDZRW8/KLeE7pE:kC72Y5Til0yx16IeJDZrSLeEV
Threatray 11'721 similar samples on MalwareBazaar
TLSH 6C9423DBDE065FDAD34058386A1769D813AE666E186A7F627C33FC88BF746D07880413
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blinux.thesecurededicatedserver.com
Sending IP: 198.52.104.94
From: Purchase Department <sale@quicknet.me>
Reply-To: Purchase Department <sale@quicknet.me>, Purchase Department <sale@quicknet.me>
Subject: INQUIRY/OFFER
Attachment: Order 88633.xz (contains "Order 88633.exe")

AgentTesla SMTP exfil server:
mail.bulletlogistics.in:26

AgentTesla SMTP exfil email address:
bangalorenarasapura@bulletlogistics.in

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/33787/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/400567
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c53185f575195f3621b1b2cd4f8e95f60098dd6340c8492a90fb1c0d880ee7a0/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 14:21:07 UTC
AV detection:
38 of 47 (80.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yuyyl5lvdfptminrwlgu7duv6yajrxldideeskuq7moa3cao46qa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
25e5574fa2c12795a3dfccffa7566eabc55508357e4914f1ae653dda2bb6729b
AgentTesla
2b959630e96963b865a8f048f31385980d0f2aabb02846cc349278489dcf72b3
AgentTesla
597ba10cc7ef72e08723d7590211ea1224f87ff781b93dcc6bda9cd33105d505
AgentTesla
602d15fb9c4ef66396b54cc09e891dd39ec976a725c525609b22750d06c3ed29
AgentTesla
62005a4721dc55f0752df55ca79bd85ccb46ba28a34d10d8f29880e087b69896
AgentTesla
7c6da3c6cdc2c4ba881925e305c2c2044105546e0b7a8ca1d8c523d8584be05a
AgentTesla
99ebc0bf98a16152a009ceb9f57f5ffc55153422f23c80b34b7046cf21eec353
AgentTesla
ab0c0499cd88035d08c86f41c369fd6c06cca17eecbb5fb06af842fca3f4d227
AgentTesla
ce0257b16f4bfe10b1e98e9f7c332ec4fd4766a093c5462a32394282c6a5120e
AgentTesla
fb9ef9299560ef8ce20ccecc38804303b2f49e31955277075d580ec76d167682
AgentTesla
+ 11'711 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/200728-lbq7x5kqs2/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c53185f575195f3621b1b2cd4f8e95f60098dd6340c8492a90fb1c0d880ee7a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 76dc4791a08b5808343ffb6b7798aebdfe4daf0140242c31716ceffde36737de

AgentTesla

Executable exe c53185f575195f3621b1b2cd4f8e95f60098dd6340c8492a90fb1c0d880ee7a0

(this sample)

  
Dropped by
MD5 3bed63a3f6744af6e139f84b0f2646b5
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 76dc4791a08b5808343ffb6b7798aebdfe4daf0140242c31716ceffde36737de
Cape
Cape
https://www.capesandbox.com/analysis/33787/

Comments