MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6
SHA3-384 hash: d7a8644c87083c5116a78bd02646bed238efd164ee86c207a99595cc599e631efe7df09c71598b5eef1fbe538a6d4226
SHA1 hash: 042b99a97749b4e61dcfe0bbafc38e8b508e271b
MD5 hash: 9c63aa40d3def6ab9c83628bb8206dee
humanhash: nitrogen-uncle-california-march
File name:pricing list.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'176 bytes
First seen:2021-01-14 20:22:13 UTC
Last seen:2021-01-14 21:35:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2087285a50d01bf3729a786c15ab23ed (6 x Formbook, 3 x RemcosRAT, 3 x Loki)
ssdeep 6144:+Gp8iWZT32WKaUAOCpj0dtxDSTF8i5unioO3foa+sjy6Eq1mro4uRZ9a2cPpwoQ3:+GDWZb2WKaUr/i5cioOvmUpTIp2uSMA
Threatray 2'350 similar samples on MalwareBazaar
TLSH AA94010872D2C073E4A2123059E8A7B76A79A831177050EBF7EC152E4FB83E166753DA
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: arionmail.com
Sending IP: 172.93.187.131
From: David Lum <woojinchems@arionmail.com>
Subject: S3500//Pricing.
Attachment: pricing list.tar (contains "pricing list.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
pricing list.exe
Verdict:
Malicious activity
Analysis date:
2021-01-14 21:23:19 UTC
Tags:
rat agenttesla trojan
Link:
https://app.any.run/tasks/7a5213a7-d61c-4e5c-b8f1-d0ef4197945a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/112103/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.7481.13766.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/581854
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 339975 Sample: pricing list.exe Startdate: 14/01/2021 Architecture: WINDOWS Score: 52 10 Multi AV Scanner detection for submitted file 2->10 12 Machine Learning detection for sample 2->12 6 pricing list.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-14 09:49:22 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfkc2xhe23qwf2o5aa33szc4m5if6widsrrlkcfrv347ixivn63a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
266a17ea6c2608d4ed7b8495fb387c649e62224c9eb81b0d6199f12b7f7cdc6a
AgentTesla
2f5342dc12629b9db5c1f64b130401580d4a20a862be9293f80942d01c162f32
AgentTesla
4ed4c6dc0931fc532768d6b208faf7ed7281427c417a048a013c8a7104707582
AgentTesla
53f89ac782afeef77891b25e92440050a0bb224ff1eb439ac787364335b661cd
AgentTesla
75264b6aba2081bf00b5744a1e78f0c2cc933ba030372ead5e70b1783e649e4a
AgentTesla
9888381eb68d98f0581ab81845f2fc9e15af6ba1193a131bdf60497e3a3d1247
AgentTesla
9e98384954932a0a9e5f921f257029bf45f721b0d279c8432c4eb5f1bf507795
AgentTesla
ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97
AgentTesla
de6f5b39f4129ed442da26837a296a2b2e9573af841cc7fc41a5a72d4c673de7
AgentTesla
f05b74930aa9777625a66d2852fb0b690461ef0b5598d35b2d7959721456600d
AgentTesla
+ 2'340 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210114-2blyrbtysj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6
MD5 hash:
9c63aa40d3def6ab9c83628bb8206dee
SHA1 hash:
042b99a97749b4e61dcfe0bbafc38e8b508e271b
Link:
https://www.unpac.me/results/4b2476dc-9c17-4231-b311-935752a2f752/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

tar 9e009edc9d00f4466d1cb10eb43a628daf4bf0d853138323800b8f2307f4e185

AgentTesla

Executable exe 09542d5ce4d6e162e9dd0037b9645c67505f59039462b508b1aef9f45d156fb6

(this sample)

  
Dropped by
MD5 1cac6a291312091eb7cb549bdd7675c2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/112103/
  
Dropped by
SHA256 9e009edc9d00f4466d1cb10eb43a628daf4bf0d853138323800b8f2307f4e185

Comments