MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05ebf37e9b99d3559e820dbc7c2181130659076865194febca741828906f9f58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	05ebf37e9b99d3559e820dbc7c2181130659076865194febca741828906f9f58
SHA3-384 hash:	dff9d702454547429db364a44b2d73a8fd7a2de626688e0fa217a4aadd26d5c0af99c58488dd004ea871142050580c38
SHA1 hash:	9975cdf9f84ac1107d53d868fbba310f56fb89d6
MD5 hash:	d1133e3600d1373172db5a7d740f5e7e
humanhash:	uniform-illinois-uranus-queen
File name:	ORDER-P.O IM72E91AL.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'251'840 bytes
First seen:	2020-11-06 17:31:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep	24576:1AHnh+eWsN3skA4RV1Hom2KXMmHaIt4o5vYbA1U+ewctAoy5:kh+ZkldoPK8YaIuoFn1/IU
Threatray	874 similar samples on MalwareBazaar
TLSH	B045BE0273D1C036FFAB92739B6AB24256BD79650133892F13981DB9BD701B1273E663
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing unidentified malware:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: Shūzhēn Zhéwěi <info@sunmatch.com>
Subject: ORDER-P.O IM72E91AL
Attachment: ORDER-P.O IM72E91AL.rar (contains "ORDER-P.O IM72E91AL.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.AutoIT-3.UNOFFICIAL

SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Launching a process

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Forced shutdown of a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/523498

Signature

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05ebf37e9b99d3559e820dbc7c2181130659076865194febca741828906f9f58/

Threat name:

Win32.Trojan.Predator

Status:

Malicious

First seen:

2020-11-06 09:54:17 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=axv7g7u3thjvlhucbw6hyimbcmdfsb3imumu726koqmcredpt5ma._file

Verdict:

unknown

AgentTesla

48b1f899e7ad8d880a6bf9d97ada6507c4403c8d8e81815f83fb8181ca247008

AgentTesla

5dc99cdcbe826905fda928debc00fd44e0d447e1b797e74c11a8bd77133dd770

AgentTesla

6d1cfff093998c807b9c5dc3fd122adbea40c5bad0cad4cbe10b43932c28bdd9

AgentTesla

89f1ed8a332907a1e20a452f773576cc53bc7bfcb2aeb20eb4501d57a5574d2e

AgentTesla

90e558ae189e039ebfb1fa64a6a6e917fbb98be91fc125dbe7b32ba305398158

AgentTesla

b052d189fbba69117efc6e10e1cada3faee844cb59b5f0d1482734976c72bd58

AgentTesla

c4644f2a1dbfb727b93ed962f0f16c40da6710795e4108e098de2e7f0eaad6f8

AgentTesla

db6c57acf61c5e3fc79190feca4683089f6a05b8af985e49361d25995178e4d0

AgentTesla

e897888dd36ab2a5740030d628f510ef0563d9d039e896b45134a4a5c4a82bb7

AgentTesla

+ 864 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/201106-dmemxxcfb6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla

Unpacked files

SH256 hash:

05ebf37e9b99d3559e820dbc7c2181130659076865194febca741828906f9f58

MD5 hash:

d1133e3600d1373172db5a7d740f5e7e

SHA1 hash:

9975cdf9f84ac1107d53d868fbba310f56fb89d6

Link:

https://www.unpac.me/results/b678e267-92d5-4dfd-8540-9092aa58e31b/

SH256 hash:

76ebfad4833463a44ca2ec78b980e07fd1557ac43ecd0ba26d31a8bd2c4c09d6

MD5 hash:

1605119d7b0aa7bbefb2f1488e0ebd8f

SHA1 hash:

6bac0a84550aa81a21e6181ec44db4b267d1675c

Link:

https://www.unpac.me/results/b678e267-92d5-4dfd-8540-9092aa58e31b/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.