MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 009408ca7bf5c48fc1140cbe594f1461defd77206be643e1f9bd548986ad636c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 009408ca7bf5c48fc1140cbe594f1461defd77206be643e1f9bd548986ad636c
SHA3-384 hash: 083bca8f9bd6c7393590051b0124457d8969f2a46cd4687910d3412e764c7074d86975e7b4d057a00c8fa708ea4e7d6e
SHA1 hash: b079d4871352b12ce8bd7a8ad15f986d2f1fa6a6
MD5 hash: d0701ed7d9f1030611b80bc4a5d375c6
humanhash: moon-alpha-hawaii-rugby
File name:RFQ 2020_06_10_PFF00.xlsx.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'080 bytes
First seen:2020-06-10 07:39:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 713f097e626243ee8d8a433eba0b590e (2 x AgentTesla, 1 x MassLogger)
ssdeep 6144:Jry9xAWBR8yu0GfZy34xDReP3COpEVjuDjcOcrsq2a/ISYHq5j:Je3BR5u0GZ04RObEusZqaASSq5j
Threatray 455 similar samples on MalwareBazaar
TLSH C3943BEE7970D3B0FC0480743C69E889924DF577599E8056FB995BA53F30A0FA8A1B43
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sarana.benvors.com
Sending IP: 45.64.97.68
From: 김진선 <jskim84@kmou.ac.kr>
Reply-To: jskim84.kmou.ac.kr@gmx.com
Subject: RFQ 2020_06_10_PFF00
Attachment: RFQ 2020_06_10_PFF00.z (contains "RFQ 2020_06_10_PFF00.xlsx.exe")

AgentTesla SMTP exfil server:
mail.kteadubai.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:41:04 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ackarst36xci7qiubs7fstyumhpp25zanptehypzxvkitbvnmnwa._file
Verdict:
malicious
Label(s):
azorult
Create hunting rule
Similar samples:
25d7c4fad856957a1a4b2a146221ca5620675edf33eeecb596a2610bb719a45e
AgentTesla
2d065db29c3cccec041bbb769dd065dd7d406bf8a4234da2774427da4ffa9785
AgentTesla
39c531db99d46a4b3906a41e6e1afdb2523106c795b11eecaf75bc3a1fbff57b
AgentTesla
63f6b1b60bad01e24355ba56b1ffee392c87858a40ecd14d76e51ebe7c3333d1
AgentTesla
71db72fdf67af76d080be2a30e8492469b63a48023286aa72ed83a322b45bfe1
AgentTesla
969ae75e9c2c901449d7159bfef10d46da50e573f4c88ff94667661729a0f881
AgentTesla
97d8ae62cb751e857b04d9eaa68ee2acce3d7243009bdb04639a729cdfc7cbf3
AgentTesla
e25b667d727278544032a0553b0ce93d6634f27be4c5abb8b7f103337bc683e2
AgentTesla
e78e7d17890f956f99183f8524d03f871bce6e82cc1794937d680c4510bb4be9
AgentTesla
ef0e8df5c700e64d5d2e8dde4c9b5c117abfc919c676ff383019c585e8e367b0
AgentTesla
+ 445 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-wgggmha1sj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 1800e1482166c648c3cb25c4f1790af2a2052fb0ee148263b28b80fe137b75d4

AgentTesla

Executable exe 009408ca7bf5c48fc1140cbe594f1461defd77206be643e1f9bd548986ad636c

(this sample)

  
Dropped by
MD5 8f900d71e1105a0c7c94d2c36cd65307
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 1800e1482166c648c3cb25c4f1790af2a2052fb0ee148263b28b80fe137b75d4

Comments