MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823
SHA3-384 hash: 7df1142560a5051aca10c7f029a96266e64a8d549eb10634ea74b13965daecb2fb80ca8ef703e7720ed677f9a4517d29
SHA1 hash: b53b5f2fd8ccf2ee7efc95def56015b3599d8414
MD5 hash: 5244699dbdbc3c2c61c3281378df6599
humanhash: golf-neptune-mirror-seventeen
File name:MAERSK BILL OF LADING DOCS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:720'384 bytes
First seen:2020-11-14 18:36:56 UTC
Last seen:2020-11-14 20:40:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:y0H6rj80r9e0V6kTjNVIC9/NjyiMoo+8eJN0uGLBt8LFblaM:y0axeavTLb5YiSPe5Gj891
Threatray 2'112 similar samples on MalwareBazaar
TLSH 51E4F1323511BDCFC65B9CB2C5443D446E51B87B8B1BE30BB88B11AD254EB8E8F146B6
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.11020.24854.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/534990
Signature
.NET source code contains potential unpacker
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 14:48:59 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=axddecxxqy4oobztxgealf6x3cxrhkugjcuh5auhchvimtg6rarq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01eea9d80166f57f6fe65ac47695ffc74bac20e1de4743d44dbcc834e88fb7a4
AgentTesla
09039ff8c6c08c31f158428d4f78123e5afc57f0751ab877d84011897c512f1d
AgentTesla
2bff7918842a32e19021595f3276402ff1e1034130ed6dfbf4f3f11dda06a52d
AgentTesla
376f3a94cb7d2af93a4a3eefb2bc9cf4972f4f6868ea8309fed1ba83bf81e1e8
AgentTesla
3813d5fe541f008c96f3a0f367113a1fa3c047f08815fcd8335c4b829523ca28
AgentTesla
45729be7af7c3a3c18d7b032a1797d63655fccd33c6e494a478356b55b29ce38
AgentTesla
4fcb20f32c0c827e9f3977a2874dd0acc7163dedcddf56004e03a38a53d720f9
AgentTesla
7323b8d5a71d744ada47370e02c8d86eb551bacb6881aee27ed7ec61cc22e068
AgentTesla
7cf016920f62f4cd984f9fdc9c9976b07888c891b52a8c6c95c47cc3628bde21
AgentTesla
ca461421154f0bfaa9b24b0ed5ea776ddeffc9775e3fdb4da1339dcc352468c6
AgentTesla
+ 2'102 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
persistence
Link:
https://tria.ge/reports/201114-yleqxllage/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823
MD5 hash:
5244699dbdbc3c2c61c3281378df6599
SHA1 hash:
b53b5f2fd8ccf2ee7efc95def56015b3599d8414
Link:
https://www.unpac.me/results/e81217fb-682c-42a3-b3a0-e7b13a113eb2/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/e81217fb-682c-42a3-b3a0-e7b13a113eb2/
SH256 hash:
a4964915b9e39587185cd9a632eabeb0983a1dae5da8676ad7753e6d592c3030
MD5 hash:
b593b94a2a8b9339c3b4567655373224
SHA1 hash:
98944294234bce9b651192e0e59a0ecd7671c7a1
Link:
https://www.unpac.me/results/e81217fb-682c-42a3-b3a0-e7b13a113eb2/
SH256 hash:
90cbfc77abe4518524d447fc1fdec09c51ae3755508d3d658cb3f7c850a6f634
MD5 hash:
733f8bf0bda5334a63cdf312f9149577
SHA1 hash:
ffea687868c6f74164cf03b953b3d673864dfbb2
Link:
https://www.unpac.me/results/e81217fb-682c-42a3-b3a0-e7b13a113eb2/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3

AgentTesla

Executable exe 05c6320af78638e70733b9880597d7d8af13aa8648a87e828711ea864cde8823

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 d4ce47da901bbddba111d2ed210c0619b58e5360477edbf91cb8e292c88a8ab3
  
Dropped by
SHA256 ee3ee78c9fbcf47e2f199a1d58df627289d96171b1a4cf35be0fbfd13db65cce

Comments