MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668
SHA3-384 hash: 183dd168e73d775f4f17b1984bd9b2a417c97ab26403075c6371e78be4043539ee702a2afe43c2320b3c6e0f84ad3090
SHA1 hash: 5bc6c412f772bcaf02a0f3be862c66ff78144e9c
MD5 hash: 5054e2111dfa29f56a920d08db037b6d
humanhash: violet-nine-asparagus-mobile
File name:DOC-INV8363753.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'057 bytes
First seen:2020-05-04 21:24:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 12288:qgtcKf9mCf21S3ev9dDSlaFCdbjkZUrXSw3PA:DcKFmy21ceFpS0AdbjSUDSwfA
Threatray 6'179 similar samples on MalwareBazaar
TLSH D684229179019173EA634D7600B65F05C7DBEE6AD8B2B0AF7744BD107AB62D3412BCC2
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.postservicedelevery.co.uk
Sending IP: 192.119.117.126
From: DHL Global Mail Inc © <ysld@postservicedelevery.co.uk>
Subject: Access Your DHL invoices AWB Number: 83630000
Attachment: DOC-INV8363753.IMG (contains "DOC-INV8363753.exe")

AgentTesla SMTP exfil server:
mail.gumarabic.sd:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.UGA.20041.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/351287
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 09:37:00 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6rrhj5etrfyyd5puzpto6ndf75d7dgvebz7yofgk4mjqonzczua._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
AgentTesla
1553300557f17e7cb62c914616267bc733854b98a0edc5215d901cc4f8e4d0f0
AgentTesla
19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c
AgentTesla
484ff6267219f9eb4794c1f20aaa9562a459e0d1a787743592b1532eda3be541
AgentTesla
496b39b696da8c81b7f0d57b3b591a9c948bf88d8ba375618703edcb18f4c27d
AgentTesla
b9c037384eaa82706baf7c3cd5e1550fe9ad24083edeb00e55d9da8198ea6ee3
AgentTesla
c158b8ed8c9a0221bfeb3dea8d026d5bb9bade9ecfd19191ada59c51c8eb4089
AgentTesla
c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
AgentTesla
e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
AgentTesla
f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557
AgentTesla
+ 6'169 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-w81qbhgehx/
Behaviour
Suspicious use of WriteProcessMemory
NSIS installer
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img e28ad452dbd7310d0a99b9d0ac6f255fc395c1ad3b83fdc48582407bf6f01b6c

AgentTesla

Executable exe 07a313a7a49c4b8c0fafa65f3779a32ffa3f8cd52073fc38a657189839b91668

(this sample)

  
Dropped by
MD5 eb5114d24726ffba76684ef244073626
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e28ad452dbd7310d0a99b9d0ac6f255fc395c1ad3b83fdc48582407bf6f01b6c

Comments