MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6623c1d81defbb2f39224fad80aa071b99b3d08788f6cd400e9c43f9c324b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6623c1d81defbb2f39224fad80aa071b99b3d08788f6cd400e9c43f9c324b0b
SHA3-384 hash: 33d5220ddcd02b0141eae888b1de739319a3f6bb5941327a3fcbed6478b922abf7fa8444ad3971ead8ff914935ea797b
SHA1 hash: 6f00a25625599b53f2b9a0e6684961f9d1a3a2c2
MD5 hash: 5d9b9e9ea7584deb372cea7744c5580e
humanhash: moon-romeo-hamper-yankee
File name:Swift-copy.com
Download: download sample
Signature AgentTesla
Create hunting rule
File size:792'064 bytes
First seen:2020-07-20 10:15:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 947a363cee796918c4dd5f0352950426 (5 x AgentTesla, 5 x Loki, 5 x MassLogger)
ssdeep 12288:CpxEDrQY5EvoFzhlmTS1i4jkkg52CKRC8fZ9Gc7u7ks3Q3XNc:Sa8voVOIObYfZoqu7kgT
Threatray 11'159 similar samples on MalwareBazaar
TLSH 47F4B026E2E04877C1771A3C4D1B66B8A836BE113E2C99766FF74C4CDF3A64034A5297
Reporter abuse_ch
Tags:AgentTesla com


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: esperanzaeg.com
Sending IP: 173.254.250.2
From: planning2@esperanzaeg.com
Subject: RE: Outstanding Payment
Attachment: Swift-copy.tbz2 (contains "Swift-copy.com")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28915/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/391310
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 248039 Sample: Swift-copy.com Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 30 Found malware configuration 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected AgentTesla 2->34 6 Swift-copy.exe 2->6         started        9 ZTTAXVpp.exe 2->9         started        11 ZTTAXVpp.exe 2->11         started        process3 signatures4 36 Detected unpacking (changes PE section rights) 6->36 38 Detected unpacking (overwrites its own PE header) 6->38 40 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->40 42 Contains functionality to detect sleep reduction / modifications 6->42 13 Swift-copy.exe 2 7 6->13         started        44 Multi AV Scanner detection for dropped file 9->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 9->46 48 Maps a DLL or memory area into another process 9->48 18 ZTTAXVpp.exe 4 9->18         started        20 ZTTAXVpp.exe 4 11->20         started        process5 dnsIp6 28 mail.privateemail.com 198.54.122.60, 49732, 49734, 587 NAMECHEAP-NETUS United States 13->28 22 C:\Users\user\AppData\Local\...\ZTTAXVpp.exe, PE32 13->22 dropped 24 C:\Windows\System32\drivers\etc\hosts, ASCII 13->24 dropped 26 C:\Users\...\ZTTAXVpp.exe:Zone.Identifier, ASCII 13->26 dropped 50 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 13->50 52 Tries to steal Mail credentials (via file access) 13->52 54 Modifies the hosts file 13->54 56 Tries to harvest and steal ftp login credentials 18->56 58 Tries to harvest and steal browser information (history, passwords, etc) 18->58 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->60 file7 signatures8
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c6623c1d81defbb2f39224fad80aa071b99b3d08788f6cd400e9c43f9c324b0b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 10:17:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzrdyhmb3353f44set5nqcvaog4zwpiipchwzvaa5hcd7hbsjmfq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829
AgentTesla
3c3c2afe57269ba1438595d34dfd3db570514bcf7b404a3ae8a38f8481729da3
AgentTesla
64b1d3b8775ba302efe5a9cfaed22f3091a9c5a9daa84ca97b389d37473e780f
AgentTesla
6b0f2c8d4a8c8883be658db9868b33db30eb73755e4688279c29599eb25c6099
AgentTesla
9a99082664fba770485b23172f61bdd349863e9803d7a01170e1839026c6a0fb
AgentTesla
a37c03657109c93fc42b5fec790076eb5fae723d67a440da512073ba40003fa5
AgentTesla
a62a90789d488d851050ad121400c40bdcbad55ff7acedca829edff301b0342d
AgentTesla
b82d04c79bfd870dd7024db85a5c3c60827776af6bfd6b73306ceebf72150ba4
AgentTesla
ce0257b16f4bfe10b1e98e9f7c332ec4fd4766a093c5462a32394282c6a5120e
AgentTesla
e47d2283c026db3c1d24b547699e99b6306c795616e2d13eb107de9a6eb938ad
AgentTesla
+ 11'149 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx persistence spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200720-e9xwmjt7h2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Reads user/profile data of local email clients
UPX packed file
Drops file in Drivers directory
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/c6623c1d81defbb2f39224fad80aa071b99b3d08788f6cd400e9c43f9c324b0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 388d8f022a47d15b407e133203b79f6f6b95e57c5475cb91c7d2e4c635d06b8c

AgentTesla

Executable exe c6623c1d81defbb2f39224fad80aa071b99b3d08788f6cd400e9c43f9c324b0b

(this sample)

  
Dropped by
MD5 eb5e4da255322b75cbc3e92d2a88e60c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28915/
  
Dropped by
SHA256 388d8f022a47d15b407e133203b79f6f6b95e57c5475cb91c7d2e4c635d06b8c

Comments