MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7556976536d96e5b02f426496916b127c6159ccb3b66377fe09db2e5a6a6cd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7556976536d96e5b02f426496916b127c6159ccb3b66377fe09db2e5a6a6cd1
SHA3-384 hash: e5e2c1e13cf72f9524378ef8b9eb123c11c3f0b9e2bee3155a4ed4f9d667af4551b8576087035137d6a5572a3d2bb672
SHA1 hash: 0a1fcd59ef926d918993724436d55bf62835b596
MD5 hash: 76bf20e619d53e637acf9d13e107fe0f
humanhash: virginia-sink-network-mobile
File name:Al Mazroui May New Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'576 bytes
First seen:2020-06-12 06:40:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:pm0xFCfo9NbpLqH0MDhs8RE/NyebfUfDXV+rlS9GqSFlq0D8k/y2VVbSNplqRxOu:pm+qeDhMDhs8OwIfommtSvqNk/y8kqR
Threatray 10'885 similar samples on MalwareBazaar
TLSH A4949C7A1DFE137AC2A0C6F6CFC0C47BB550D2B33126AA39549227958347E8225D327E
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9100/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48315.26463.19086.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.NetWired
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 14:04:01 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=65kws5stnwlolmbpijsjnellcj6gcwomwo3gg576bhns4wtkntiq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
00b67f9110eea8124e983b5b261ebce4bcd82c664c8e04eb796017495464bb7a
AgentTesla
1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734
AgentTesla
3fc3fb7bfc4691907a80f689bd914ef1331e8d2a43585a377e18cfdd199e7fdb
AgentTesla
48ff192194ef184df0c18730412aa21cfb257c3ebe17651320d9d54148fba8cf
AgentTesla
517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9
AgentTesla
9054664b281021c3f1b59d7672f3633994256697514d2b810e1607541c553212
AgentTesla
b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d
AgentTesla
e2d6119bb484c9e5f5a7107b4687553416208badbb881df4328bec5146d08509
AgentTesla
e4ac2a09a403429d9e7963d523f77a214371cb373e282c9c08379ae2a951c4f4
AgentTesla
e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e
AgentTesla
+ 10'875 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-q8r3a47vb2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9100/

Comments