MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc
SHA3-384 hash: d0c1c0df29fb6b16acf70faf9d3475bf35d866d933635a5c6fd57f03ba9c522d51241ca0c74525f732265984c24658f1
SHA1 hash: 0ed84f9bac537e970eb0118f020387b28b539a77
MD5 hash: 30a220c93fa58ebecdf760c59dc45249
humanhash: rugby-ack-lactose-missouri
File name:ORDER LIST.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:572'416 bytes
First seen:2020-10-22 08:07:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:/Ov46h+D1s2cAEZzL8uFgXW4gtefzLgk9A1GKZHNYPzod:G2K9bB8uFgGRohA1GUKzod
Threatray 746 similar samples on MalwareBazaar
TLSH B0C40210719A6F32D7BE87FA202D490987F1449F93B1EA644DE276DA3AB0B00DBD0D53
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: photek.co.uk
Sending IP: 88.218.16.126
From: Katherine Pedro <sales@photek.co.uk>
Reply-To: dawnimpax2012@gmail.com
Subject: REQUEST FOR QUOTATION FOR CONTRACT SUPPLY.
Attachment: ORDER LIST.iso (contains "ORDER LIST.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74579/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 07:40:24 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c6qd4oplv627zxjqej74zyqtrxdj4nj7yhvbghst37xdwqmqzlga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
02e422396eb123142575e0dcee9f629941c42543ae8839a931e2cc8eefecb9c4
AgentTesla
5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c
AgentTesla
583e11d3579a63016e568fad73fb9f5ab64e32012ab1a0764f62191ced808078
AgentTesla
6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241
AgentTesla
6eced51e9e9f798e79627188c69026a06a576021d112c8b94ed517f2576b009f
AgentTesla
6f0c98efd3149c8527cf3f700d123da142275f32c166cf2ca2b186d1acc1286c
AgentTesla
9e5f987ad43b66c469e9fed02999cfb62feff01049b5f1ef33804918bead665c
AgentTesla
b3b1f3479b7d0033e21ef89ccea063a0281604d4472252cf590ec99be5aa2eb4
AgentTesla
dc22665dc14ec019a9f8c421c938db597c2a1b9e439c4a0a0b6dc7b1330e75b8
AgentTesla
f2848bb06faec26cdb7bf8df01c598641d0d73c8b7c58a7aed106e9864942cf6
AgentTesla
+ 736 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201022-xgtegvhch2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc
MD5 hash:
30a220c93fa58ebecdf760c59dc45249
SHA1 hash:
0ed84f9bac537e970eb0118f020387b28b539a77
Link:
https://www.unpac.me/results/19c27757-36aa-4572-9de5-011de1557b71/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/19c27757-36aa-4572-9de5-011de1557b71/
SH256 hash:
a6f7edd2654412c25d7c565cb5b52e1382799a8b86d6bc44e965b554f6344618
MD5 hash:
848162219f0e096a320c96f8e6bce3a2
SHA1 hash:
b16dc81ec21671b39e6e8b523023b9ef789d09e4
Link:
https://www.unpac.me/results/19c27757-36aa-4572-9de5-011de1557b71/
SH256 hash:
856d96f8d6290f444b2a61f1b294761db7505b8e86176d37ac991e7153fbe188
MD5 hash:
9a92c545e5aa953f61ee9523d7201743
SHA1 hash:
f6e35e22a30fb2d57c5cb8e4728b98c1fc453a94
Link:
https://www.unpac.me/results/19c27757-36aa-4572-9de5-011de1557b71/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso f25b8a6d8cfeec3642271217d9a17a8246b3a1e1814001a8e46da0288159eebe

AgentTesla

Executable exe 17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc

(this sample)

  
Dropped by
MD5 7cf2078e4b53c88004f71b438e20d571
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/74579/
  
Dropped by
SHA256 f25b8a6d8cfeec3642271217d9a17a8246b3a1e1814001a8e46da0288159eebe

Comments