MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e
SHA3-384 hash: 833a1ab7a682d9b5d9c10feedca02f13db6c0514b295b7b56a34219dd36b2ff2c4eafa85460fb1ced0b14ae57fe20e7e
SHA1 hash: 34b32a1c98cc765d63c7fc67b46aeddb1c3cf687
MD5 hash: 4f1610c4fd30e19ab3e2f7ca97efbae3
humanhash: single-bacon-fix-monkey
File name:NEW ORDER #092134.pif
Download: download sample
Signature AgentTesla
Create hunting rule
File size:233'472 bytes
First seen:2020-05-04 18:15:32 UTC
Last seen:2020-05-04 18:55:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:e3vGL8VHH5M3pVMUKhB42JeOcO9Wm99ugBGvu7DxXlbpb1zRFEJ4pH9+AA1avhKX:7IM3AUKhy8T99xsvWl1zRr
Threatray 73 similar samples on MalwareBazaar
TLSH F134F47D0CFC4277C2A4C5B88FD18477B294DA3B32229D7655E383484766E8626D32BE
Reporter abuse_ch
Tags:AgentTesla pif


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hos5.host4asia.com
Sending IP: 72.9.144.141
From: Suba Air Perdana <subaaccounts@dnet.net.id>
Reply-To: subaaccounts@dnet.net.id
Subject: New ORDER #092134.
Attachment: NEW ORDER 092134.zip (contains "NEW ORDER #092134.pif")

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44194.12681.20059.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 01:39:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4tkkem3l4h6bch3igaoxab5htknyav4gjqozeqk54w2hqj4enaxa._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
0722cedd5a2e4a5a4c94ac988f14800a6a83a8c7147f7ef52b47ae86571384e2
AgentTesla
170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa
AgentTesla
1d98e18806cb0b478899854bf39ff2388225501a109405db1816066643224ce8
AgentTesla
1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734
AgentTesla
35cca711eeab74520897fa7d78a5228861e9eb0bd2f66e1aa3810784acf4f11c
AgentTesla
517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9
AgentTesla
97b8bdb2c3d831301d68b883fea274703bd497462caa192f6a09130a0f42d10c
AgentTesla
b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d
AgentTesla
ba783a6dc1161f2de26ff815457e19aa6918ad4d6bc87f048bc00975ea4a210e
AgentTesla
f7556976536d96e5b02f426496916b127c6159ccb3b66377fe09db2e5a6a6cd1
AgentTesla
+ 63 additional samples on MalwareBazaar
Result
Malware family:
m00nd3v_logger
Create hunting rule
Score:
  10/10
Tags:
family:m00nd3v_logger spyware stealer
Link:
https://tria.ge/reports/201109-fatnebf4ja/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
M00nD3v Logger Payload
M00nd3v_Logger
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c7e870a2809a5014b8b7f744e162a88758965f534dc1fe4342e1c393aab9c7f0

AgentTesla

Executable exe e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e

(this sample)

  
Dropped by
MD5 1c7be89710eb05c309ff3763c8d73c61
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 c7e870a2809a5014b8b7f744e162a88758965f534dc1fe4342e1c393aab9c7f0

Comments