MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb28a89e1067428e1cd2c8fd9d41d297a09e5e1f6a1698f70d56871a49f8bc51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 3 File information Comments

SHA256 hash:	fb28a89e1067428e1cd2c8fd9d41d297a09e5e1f6a1698f70d56871a49f8bc51
SHA3-384 hash:	946df4f807ff1a8f55ba0d60959123f35ef014196bf7dd753609ee6e64a46cecd770f4aa6db7fa592caf85737f9425d7
SHA1 hash:	e8aac6b4a4bda400e035e9abce8005840150bcdd
MD5 hash:	07817c3519548de3be1d127fabdb7ec6
humanhash:	hot-illinois-juliet-nevada
File name:	rlJPEcInJxOdLje.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	872'448 bytes
First seen:	2020-07-08 06:32:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:Tn9tBjycsdjGynkiyIGrYe3vfaW+1U9hKlXwsHZ/WNNxShKlXwsHZ/WNNxb:zLKdjdXr23F+1WslhtWUslhtW1
Threatray	10'934 similar samples on MalwareBazaar
TLSH	0205D035BBA59902C77E4F32C86311109E76A9A7AE07F68F5ECC21ED4CA7B441913B07
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: postmaster.mediaclick.com.tr
Sending IP: 213.159.28.168
From: BURSA-VALEO OTOMOTIV-CLUTCHES <mahmoud@nonamegroup.co>
Reply-To: saleslink@yandex.com
Subject: PO_4130000679_1593759364/ INVOICES
Attachment: rlJPEcInJxOdLje.xz (contains "rlJPEcInJxOdLje.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Enabling autorun with Startup directory

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/fb28a89e1067428e1cd2c8fd9d41d297a09e5e1f6a1698f70d56871a49f8bc51/

Threat name:

ByteCode-MSIL.Trojan.Masslogger

Status:

Malicious

First seen:

2020-07-08 06:34:10 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mukrhqqm5bi4hgszd6z2qoss6qj4xq7niljr5ynk2druspyxriq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

7c19cbbbb385a448d0033fe89cf139fff95ea9760ac2f0e9fa9acac60d180b81

AgentTesla

93333039cc8d0939fbd91cb9d6b4a49d654460b0559bc8526bbe57716da0c121

AgentTesla

943cfd0d793dc383dfa4672bf1d2b6b67d4e4dd75b3de9fefcbbdf1f33027f8c

AgentTesla

95e40490a7ab8bc996d2a8a42233563ed067317e7b54a4083808a0d77ee2a5f5

AgentTesla

c134ba3043baebc93025b74a07ce9a439ea463fce0a43d4d9ef15d62871e28ce

AgentTesla

d3585150a0d7118b7d4dd19bb781d4eee5887fa56bdd61a337181a9ff24f023f

AgentTesla

d823d3c8c26635339f3de0090fb21441f5d2f4db1a0567b2028ca8e3e7f5670e

AgentTesla

e6d6cda38ec798c76fb5727c7af199c496408484c68f3d7c0d34d6be09900ca0

AgentTesla

f5116b9b63b421105c70ed959874666013dd180ca81496faa067062c7d989060

AgentTesla

+ 10'924 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

spyware keylogger trojan stealer family:agenttesla

Link:

https://tria.ge/reports/200708-tsb6v7d622/

Behaviour

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads data files stored by FTP clients

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar