MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff33e7e3a8e17b8d26c616b15ed294692d82321f4ccdc2d547abf60ebc413bd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff33e7e3a8e17b8d26c616b15ed294692d82321f4ccdc2d547abf60ebc413bd3
SHA3-384 hash: 49f5ce8d8003f02adcf95dcfd2b369ba490a394bc53f564e1d6bd487308fff862932c724ce0e21a4a777f16a998ca25f
SHA1 hash: 843655b743da3aafc8d2aa1b242b8bf3a554d3fc
MD5 hash: a8957f5ecb9c4fbde7e32a24470dfde2
humanhash: lemon-early-berlin-alabama
File name:Data sheet of Purchase Order 354578967.img.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'608 bytes
First seen:2020-06-29 05:44:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:tHwJ6oB2q/BM/SxtcW3cl4tB8mBVhkVcB8eK9pQ:tHwJ6K2qA+tjI4XfBVhk4K9C
Threatray 10'608 similar samples on MalwareBazaar
TLSH 5BA4E02073BA5F6AD5BFC3FA19624A108FB6699A6621F70D4DC330EB1426F018E51F17
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sltidc.lk
Sending IP: 124.43.128.148
From: Ankur <ankur.aa@aametalscrap.com>
Subject: Order for Poly Bags for US
Attachment: Data sheet of Purchase Order 354578967.img.rar (contains "Data sheet of Purchase Order 354578967.img.exe")

AgentTesla SMTP exfil server:
almashosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15311/
Detection(s):
SecuriteInfo.com.Fareit-FVR97B1CDB35EA0.28661.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff33e7e3a8e17b8d26c616b15ed294692d82321f4ccdc2d547abf60ebc413bd3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 23:21:03 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74z6py5i4f5y2jwgc2yv5uuunewyemq7jtg4fvkhvp3a5pcbhpjq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
20fa03ed146d67328f48a4609fd5a1f2f584576dcb93450661d4b6e1f9c269da
AgentTesla
3fd5ba3e505eb66a8bb5d5eab88da4a0ca58d00ff474a8c0ab65e7843d98941c
AgentTesla
617d412ea96ae9c5d0934c714a811b839015e763c2731879dad2cb998336a3fb
AgentTesla
677cd89b052993db94346f82c1a00e3d022621ab71cd8101e41645d6f0a9933d
AgentTesla
738acd1b73b637e5aabce4ba985c985ba24917066adb94dd0773a7498649ad5d
AgentTesla
73b78f2caff5099ed61689ba82eaa2d6dc19bb1fa2d619b9429d5f876a0ecd68
AgentTesla
7850417d2c934eda23e7c968df7b7ef4d76c85328092b10826c3a8652388dba7
AgentTesla
81f0bf1ca5237ca0681c70e229cbd46307bdcf8d67e20ad0f328973921d7480d
AgentTesla
d1789b671449fd0d419fe349473b1504222a8f2ef1361c00bd4fdb1628faea48
AgentTesla
ff3ae499f8f7e4682acd374391c6a8ae492cf0205ccd02a20a18f76cae6409c1
AgentTesla
+ 10'598 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla persistence
Link:
https://tria.ge/reports/200629-hd2rqeanys/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Adds Run entry to start application
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4d7310d27dc06f95653c16187c7b8d98307f8490982d1b8d0523704716a88428

AgentTesla

Executable exe ff33e7e3a8e17b8d26c616b15ed294692d82321f4ccdc2d547abf60ebc413bd3

(this sample)

  
Dropped by
MD5 f0fd7ca71e75e798f143e66859d1b413
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4d7310d27dc06f95653c16187c7b8d98307f8490982d1b8d0523704716a88428
Cape
Cape
https://www.capesandbox.com/analysis/15311/

Comments