MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f41d910195a48409a0d7047fa3e9d2d62b19361c92f8f2f045d9a4ba7a0e869e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	f41d910195a48409a0d7047fa3e9d2d62b19361c92f8f2f045d9a4ba7a0e869e
SHA3-384 hash:	0b8bd4be9f244ddf26e2445a7dd4a42cfb87db1111f2e1ec5772d26b207543f43db00a1682a9acd8683fb121d3e44b53
SHA1 hash:	8989938d196fb0e6981b71201c41d301f381ff9e
MD5 hash:	64408fc55c01c6541b12602a400280e5
humanhash:	sierra-fanta-kentucky-video
File name:	FA.2020.06.5597.DOCX.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	392'704 bytes
First seen:	2020-06-29 12:43:39 UTC
Last seen:	2020-06-29 14:14:30 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:Met9mFZH6xRF3Jnb5HCFvW0aXJXZadKj7:U6PbBrTF
Threatray	606 similar samples on MalwareBazaar
TLSH	C984B52BBD85EA19C1085933C0EF190053B5AAC22673D70F7EDAB76C0E413A77D562AD
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing unidentified malware:

HELO: myown.com127.0.0.1
Sending IP: 2.56.8.14
From: contabilita@linificio.site
Subject: Pagamento Recusado
Attachment: FA.2020.06.5597.DOCX.img (contains "FA.2020.06.5597.DOCX.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/16297/

Detection(s):

SecuriteInfo.com.MSIL.Injector.UZM.10016.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f41d910195a48409a0d7047fa3e9d2d62b19361c92f8f2f045d9a4ba7a0e869e/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-29 12:45:09 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6qozcamvuscatigxar72h2os2yvrsnq4sl4pf4cf3gslu6qoq2pa._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5198b4007fadf961785c4de8ae84ecfa8d973daf2583d420bf77c2d58f1eb86a

AgentTesla

6ec6d3425cc3bdc664f5938119469a2947ad061dac33fafbd303998c9311a254

AgentTesla

70f8a912b0343b177f6c04ea6a642dd85f68044728e5481e86cfe8311ed86e21

AgentTesla

72146e890efa1de6ee90e445ceb11ad9dc3b053fa5e82757756a393ee4617a77

AgentTesla

72613ff71f562a69888fabe2317276332597acdef93135293aa3193686012504

AgentTesla

7e72084065a862db54cde005432cbced6d6955d9d67380befbc5aa1a0eaa8247

AgentTesla

ab73714788b9dc00470ea8ab91b4e6965546b9768cd3a897e4ca042e3303b126

AgentTesla

b798221ccec725496422cb9bf4b9adec8fef3d8228398ddd9c001f63bf84c949

AgentTesla

c6699928167cb50230cefe4ffef7fdcc10923de726d685d1a10ce4b6f8274d39

AgentTesla

+ 596 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

persistence spyware

Link:

https://tria.ge/reports/200629-e7pvcrjgxn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run entry to start application

Loads dropped DLL

Drops startup file

Reads user/profile data of web browsers

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.