MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff19c15134db88b925786ecb0a75fec4080a63ad61491e86517e0dccbac03053. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff19c15134db88b925786ecb0a75fec4080a63ad61491e86517e0dccbac03053
SHA3-384 hash: 2f2c6807fb41b6e1b71c341a5a731ea1c75d12c7941a60a84807d98221aa487cc5b3a93b31edc274821924277a4f04d9
SHA1 hash: 61244aaae381c41d6e8246276377276ef3937dbf
MD5 hash: 4664df23f5dfd53cb1071e9304311af9
humanhash: oscar-rugby-london-winter
File name:Notificación de paquete de DHL pdf.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:782'848 bytes
First seen:2020-05-01 11:01:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f52f1f062ba3dfd93d9913368e901b1 (5 x AgentTesla, 4 x Loki, 1 x NanoCore)
ssdeep 12288:v7wsA2hKOCdcqGjavPNe1SZ1xbv6sNiJbnUH73U1u6Vj9fKqxn8ulP4ia:j7A2wpdcqwkcIpNebOAVt8ulPa
Threatray 10'983 similar samples on MalwareBazaar
TLSH 37F4C032B1E15C33D167267C9C0B6768AD2ABE102A6874866FF53D4C9F393D1382A1D7
Reporter abuse_ch
Tags:AgentTesla bat DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sau-f9894-or.servercontrol.com.au
Sending IP: 118.127.60.69
From: DHL COSTUMER CARE <dean@peelelectronics.com.au>
Reply-To: nahil.via@dhl.com
Subject: Notificación de envío de DHL
Attachment: Notificación de paquete de DHL pdf.arj (contains "Notificación de paquete de DHL pdf.bat")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.LokiBot-7744093-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Injector.ELSC.32193.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 11:36:25 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74m4cuju3oelsjlyn3fqu5p6yqeauy5nmfer5bsrpyg4zowagbjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1933047daa20bb10d832d589f39d4c0ae7035691041af24d218dca5ac83c5f92
AgentTesla
2147e8f4dd7869aaf37871f8f2879c7fda153ac5fed9750e0a55453e72eef710
AgentTesla
460fa5b8dd75116e68328d16996e31acbdb17183d127bc535a86df01889bd08f
AgentTesla
47c8fab622177ddaa495e4b9294c0949be6c7572ef15f831ee7c326af0200ccb
AgentTesla
47dc93d9f50e610072c38ed05d454b31b9a4d9c31f2abc75840dea36ec4ef374
AgentTesla
506fd293063c74af7a3a513778629c01117ae57bea33b1bfff199999a690536b
AgentTesla
7ff0b93f3ac5f3acfe8f9718a8c6d0828e65f39e08cee553312cd24d8aed6dd1
AgentTesla
a21c8651404d572a8074ffe3fbe15aadf04f2a85d57333dae44f253a7c0a5e03
AgentTesla
a298c08fb2a91450f6b1e2af86fbc8ece3c290e1812c4a4ee77ce273b595c2b2
AgentTesla
c4c8770d23abfebf060ae159e67040f060e9e0dbf5b2838a089533b1a7278cf4
AgentTesla
+ 10'973 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 2064534e4e93271483b649934c966efef67d8568cd0d29a57066ab0beb3afb16

AgentTesla

Executable exe ff19c15134db88b925786ecb0a75fec4080a63ad61491e86517e0dccbac03053

(this sample)

  
Dropped by
MD5 86d52febe80e9be7527ddd377f33b8c3
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 2064534e4e93271483b649934c966efef67d8568cd0d29a57066ab0beb3afb16

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetDriveTypeA
kernel32.dll::GetVolumeInformationA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowA
user32.dll::OpenClipboard
user32.dll::PeekMessageA

Comments