MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e9d5427b5fe94f3e47377c69ccf27713415d7067c49b0c724fa118a7c343ae3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	0e9d5427b5fe94f3e47377c69ccf27713415d7067c49b0c724fa118a7c343ae3
SHA3-384 hash:	bf7ff27bce465738d95240fb8969bbd5033f170f62e716da7ffb73aa18ee1f40c5a4f3117d086c1f31087472673f1ef2
SHA1 hash:	a39079f06774c42e8ee7654ef5d9a6e3fc4b15fa
MD5 hash:	f12fd07625ccb848325c0174edbf832a
humanhash:	social-cat-potato-steak
File name:	Reports.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	684'544 bytes
First seen:	2020-10-16 17:46:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	071a0ebcd14712417aed4dab59114f0a (2 x HawkEye, 2 x NanoCore, 2 x Loki)
ssdeep	12288:ZjrO6H9mZruSupFuzv+Bz3JJoO6gBGIXI8TmtxkPJbZJ0rj:5lEuzpFz38+MITTmGdJ0v
TLSH	C3E49DE7E2FD4537C167263C9C0B5764A8F9BE502E28F8462BF91D4C4F39641386A293
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: serv.misrsteel.com
Sending IP: 138.201.220.106
From: accoun <accounting@onkagency.com>
Subject: Re: legal steps in arresting your vessel due
Attachment: Reports.zip (contains "Reports.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/72224/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

PUA.Win.Adware.Webalta-6912039-0

SecuriteInfo.com.Variant.Strictor.250317.26547.13191.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/494027

Signature

.NET source code contains very large array initializations

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0e9d5427b5fe94f3e47377c69ccf27713415d7067c49b0c724fa118a7c343ae3/

Threat name:

Win32.Trojan.Ymacco

Status:

Malicious

First seen:

2020-10-16 15:49:43 UTC

AV detection:

28 of 29 (96.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=b2ovij5v72kphzdto7djztzhoe2blvygpre3brze7iiyu7buhlrq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

upx spyware

Link:

https://tria.ge/reports/201016-1trvqnrvgn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

Unpacked files

SH256 hash:

0e9d5427b5fe94f3e47377c69ccf27713415d7067c49b0c724fa118a7c343ae3

MD5 hash:

f12fd07625ccb848325c0174edbf832a

SHA1 hash:

a39079f06774c42e8ee7654ef5d9a6e3fc4b15fa

Link:

https://www.unpac.me/results/aceb8565-322b-4e68-8f75-88b6f207651d/

SH256 hash:

345b2e4e3a2e776d22a53216cd17b3f05a4dec864039baf441c0bb63713ff800

MD5 hash:

778777f522660a6a15e768b9a851e029

SHA1 hash:

d17ac15d1b9ce398286f5848f8e73f89a00411af

Link:

https://www.unpac.me/results/aceb8565-322b-4e68-8f75-88b6f207651d/

SH256 hash:

b34aadffc8701d69be8cf3e3ad208039616b8dc8b68ee09901122a5d28b37d88

MD5 hash:

b5dc248a561ea355cb0225c46d016cd8

SHA1 hash:

c4b4bbe3ffb55139357e92cc4a745bffae03a8e7

Link:

https://www.unpac.me/results/aceb8565-322b-4e68-8f75-88b6f207651d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0e9d5427b5fe94f3e47377c69ccf27713415d7067c49b0c724fa118a7c343ae3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.