MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f155dd64a514c9ea5ffc36222d1c66c8daf6416945dbc8e8dd7a5b2cefae02d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	f155dd64a514c9ea5ffc36222d1c66c8daf6416945dbc8e8dd7a5b2cefae02d3
SHA3-384 hash:	453eb75a56a8be734adb87cdffd5df82ed01a3361907296e798ff22cc3f5299ca71a05b08b81a295cdc99ef44a33f972
SHA1 hash:	468ab8ea506b202d06240dd1d06fc2b70de51af2
MD5 hash:	c12700a437eb04514593fead2cc67f58
humanhash:	mobile-cola-robert-equal
File name:	Purchase Order.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	605'184 bytes
First seen:	2020-08-03 07:19:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:YTyxNbZ9of2GDudpXUAutmVHenkqpgalxjVQvKAlHk6P0S:kkl6uPUA0mU/jVGMS
Threatray	10'612 similar samples on MalwareBazaar
TLSH	42D4CF7C07E00A29F9AE1BBE9C730503DF25F45B6826A38F06B154B948B7B989D50F53
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: agswitch.com
Sending IP: 37.49.230.200
From: Arun James <agsqatar@agswitch.com>
Subject: Purchase Order
Attachment: Purchase Order.Z (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Trojan.Inject3.46680.19655.18178.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/407469

Signature

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Moves itself to temp directory

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/f155dd64a514c9ea5ffc36222d1c66c8daf6416945dbc8e8dd7a5b2cefae02d3/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-03 07:21:09 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6fk52zffcte6ux74gyrc2hdgzdnpmqljixn4r2g5pjnsz35oaljq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

1d835ccaee0da78b01a8e8b1d738f195c8fc08ddcfa7da17223645a2bf47df04

AgentTesla

2f42e1baa78e2d7160734d4a9a849cff5f95cc2f7dfa161aa9c62429a0058dbe

AgentTesla

53a05748df93fa8c44d170d47a1abd61ec9ec27980867c7cb87d3d9841f70ccf

AgentTesla

76eb0a1ac3b7d29521384b9b1a600a6373c8c4ee93cdd2dac857f6add06c9800

AgentTesla

850541657f538f00222c3a538866386f9bdd3f3a40998dfe1c22445619ee2d4b

AgentTesla

a540201f44f378a2bcade1e6190cd5784ae7cc0bc0f1138436afeb7b10ef7050

AgentTesla

d6f534c9ada1be06a4a8e186506a6807f6f2c26b2d0b4c3178d95b7fd09817f4

AgentTesla

e0b95a4255056cbad985d2d8e2ef1ab22720b758af99bd8d15a5d2d81d650fff

AgentTesla

ec0f65afbe2adb5bccb4d4b0fa58353791deb99e42a2583828442a68af1cd235

AgentTesla

+ 10'602 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer spyware trojan family:agenttesla persistence

Link:

https://tria.ge/reports/200803-q5vntbvtwj/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Adds Run key to start application

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f155dd64a514c9ea5ffc36222d1c66c8daf6416945dbc8e8dd7a5b2cefae02d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar