MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe44809b71f33523265fb0fd11442d68c68e0312d8e6085ddab6226b993c6667. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe44809b71f33523265fb0fd11442d68c68e0312d8e6085ddab6226b993c6667
SHA3-384 hash: cb29fa635d4360e1e2adf722a5f06dbb6c80c7502b59ea90337ef703baef12ce6d48ad5216136ed847d722e3605faf10
SHA1 hash: dacd5d58051766b0389bc8f143afc664f4e05e93
MD5 hash: 2f1661bdb005ce65954e3872f2cae8ac
humanhash: double-ceiling-delta-maine
File name:OetNZMCFvQZb454.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'262'592 bytes
First seen:2020-08-05 09:21:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 24576:Y/766Cl2DfgfFyoHwt0Ues3Uhd8n/T5HuHmZ6Jjsrh71kzgTctpwKpw4Bfy:Y/766Cl2sfFyoCz+K1OGgJjsrlegTcto
Threatray 10'703 similar samples on MalwareBazaar
TLSH C745E0A13A84DF8DC86E0F3134272850EBE1AE061E05F64FACD776FC5AB564A4E1674C
Reporter abuse_ch
Tags:AgentTesla Endurance exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Airblast surface treatment solutions <federico@redbill.org>
Subject: Payment confirmation
Attachment: Invoice.img (contains "OetNZMCFvQZb454.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39328/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/410813
Signature
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257725 Sample: OetNZMCFvQZb454.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 31 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->31 33 Sigma detected: Scheduled temp file as task from temp location 2->33 35 Yara detected AgentTesla 2->35 37 5 other signatures 2->37 7 OetNZMCFvQZb454.exe 7 2->7         started        process3 file4 21 C:\Users\user\AppData\Roaming\BCjvDX.exe, PE32 7->21 dropped 23 C:\Users\user\...\BCjvDX.exe:Zone.Identifier, ASCII 7->23 dropped 25 C:\Users\user\AppData\Local\...\tmp4C74.tmp, XML 7->25 dropped 27 C:\Users\user\...\OetNZMCFvQZb454.exe.log, ASCII 7->27 dropped 39 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->41 43 Injects a PE file into a foreign processes 7->43 11 OetNZMCFvQZb454.exe 15 2 7->11         started        15 schtasks.exe 1 7->15         started        17 OetNZMCFvQZb454.exe 7->17         started        signatures5 process6 dnsIp7 29 gsmtp.me 185.36.81.140, 21, 49733, 49734 TELE-ASTeleAsiaLimitedHK Lithuania 11->29 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 Tries to harvest and steal ftp login credentials 11->49 51 2 other signatures 11->51 19 conhost.exe 15->19         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fe44809b71f33523265fb0fd11442d68c68e0312d8e6085ddab6226b993c6667/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:23:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zcibg3r6m2sgjs7wd6rcrbnnddi4ays3dtaqxo2wyrgxgj4mztq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
02c2005db700502924f6ef390445b277d1d026553f1917cb85b043144888c70c
AgentTesla
05edd34599c72eb34ae0592a1ff4f626309d3819b801c2305d3b8f2965b7b100
AgentTesla
0b7ce1f0ac26b49228deafdaaaacca9f65bddf198212f8bcad11907b67e5fc9d
AgentTesla
0e1398abdfa85e32529125bf46eca2248faa7baa07f114ead8e310fc05a73beb
AgentTesla
42482d36162c303c7dd784ea301aa70e666cfb2659ccbbef0424f4e1081c449f
AgentTesla
642f3ac7ce246c87fed41bc3952ed2086187587f34a5b27270ac3c1ffca8aff3
AgentTesla
7990e636a24b5ae04b8ce433cdcb9ce20d47e60ccca30e6ee5622827a4d67f51
AgentTesla
7cbbb45108b03b6052b1d17a50d96f7ab43d16e6ae990a0d588c0cdefe2eab53
AgentTesla
99018a172fc8ca8a7cb4435e90e2f162064516d1d1c09f9545ae11741cbc7804
AgentTesla
e38221d0c30adfaf57d9059494105c09264d31aa5f8ee3daa5658dab9d895f35
AgentTesla
+ 10'693 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200805-7bqblqpe9a/
Behaviour
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe44809b71f33523265fb0fd11442d68c68e0312d8e6085ddab6226b993c6667

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 8f7d7f99611c9036aa088e87dce08978449bbc5853500340583e3ada07c71791

AgentTesla

Executable exe fe44809b71f33523265fb0fd11442d68c68e0312d8e6085ddab6226b993c6667

(this sample)

  
Dropped by
MD5 3eca6c34fe3ad58ad80310fc6c5b4056
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39328/
  
Dropped by
SHA256 8f7d7f99611c9036aa088e87dce08978449bbc5853500340583e3ada07c71791

Comments