MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 177637587fa45434d33c0d48b3360aeb56cddf59611f17f0ebdafc82d22d7052. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 177637587fa45434d33c0d48b3360aeb56cddf59611f17f0ebdafc82d22d7052
SHA3-384 hash: fbc7584b2b7a5e4c120529b50c0f6d690560c1907ff164223a9ce9ea2708b5410bdd5ddd3a3c3d08d7f5971613944d67
SHA1 hash: 231a928775c578cef1398f825ba719fdc7f3dc21
MD5 hash: d0925979b7461226715b720c15a0504e
humanhash: quebec-solar-mars-montana
File name:Dhl1045892936H.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'311 bytes
First seen:2020-05-07 11:41:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:WQLFhfB4noXJCqkdZhh9Pp9alu1Cwe4KuzLdySttrt0qtfLXOzTCK+ztmq3KaEbw:7FJ6FNhlp9aluRrdyatBBtWTCK+ztxEU
Threatray 6'185 similar samples on MalwareBazaar
TLSH 3A84228A52E074FBD7161932143B2576BB6B0F7700A5728F6B90FD537AB3693842B843
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200507-1106.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 13:49:00 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c53dowd7urkdjuz4bvelgnqk5nlm3x2zmeprp4hl3l6ifurnobja._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
AgentTesla
1553300557f17e7cb62c914616267bc733854b98a0edc5215d901cc4f8e4d0f0
AgentTesla
19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c
AgentTesla
484ff6267219f9eb4794c1f20aaa9562a459e0d1a787743592b1532eda3be541
AgentTesla
496b39b696da8c81b7f0d57b3b591a9c948bf88d8ba375618703edcb18f4c27d
AgentTesla
b9c037384eaa82706baf7c3cd5e1550fe9ad24083edeb00e55d9da8198ea6ee3
AgentTesla
c158b8ed8c9a0221bfeb3dea8d026d5bb9bade9ecfd19191ada59c51c8eb4089
AgentTesla
c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
AgentTesla
e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
AgentTesla
f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557
AgentTesla
+ 6'175 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-k9kdl4js8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

973e473e83287009c6edcfae4f4119af8a62afb1b475b2c25a36455d42fd59b3

AgentTesla

Executable exe 177637587fa45434d33c0d48b3360aeb56cddf59611f17f0ebdafc82d22d7052

(this sample)

  
Dropped by
MD5 d1567152dfdcc2cac507dd71574350a6
  
Dropped by
SHA256 973e473e83287009c6edcfae4f4119af8a62afb1b475b2c25a36455d42fd59b3
  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments