MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d
SHA3-384 hash: cf284b3bdb1dcb4c638886009194b47ea5d0c0518bf1e470d6928411c434852eb03ba06ff99fa6a4fe60b75b97951182
SHA1 hash: 0437a68b8fc3a6e47d4087b2eaef1323c882b14c
MD5 hash: ed856da620bee13a4e1641f4d4eda567
humanhash: autumn-table-lemon-zebra
File name:PO_050220.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'913 bytes
First seen:2020-05-04 21:46:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 6144:gY8iJtcKX+ymTijUO0Y4gIXXe7cLdTj212otgtmrJN0WcAiSkfhxBtbFixV:qgtcKX9mGUO0yXcLdG1NaArIrXSw3P0
Threatray 6'179 similar samples on MalwareBazaar
TLSH 128413E1AD81C5B1F225863247B74F3553FB6E2238A4B0175740B6D43AFB2D28B3A643
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.dassd.co.uk
Sending IP: 192.129.254.160
From: erty@dassd.co.uk
Subject: New order & delivery
Attachment: PO_050220.IMG (contains "PO_050220.exe")

AgentTesla SMTP exfil server:
mail.swagopen.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.UGA.20041.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/351285
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 11:37:00 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dfh6peqeij4ress6fgfgs6ex5go7bxmd67cr227offnui6aqkmoq._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
AgentTesla
1553300557f17e7cb62c914616267bc733854b98a0edc5215d901cc4f8e4d0f0
AgentTesla
19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c
AgentTesla
484ff6267219f9eb4794c1f20aaa9562a459e0d1a787743592b1532eda3be541
AgentTesla
496b39b696da8c81b7f0d57b3b591a9c948bf88d8ba375618703edcb18f4c27d
AgentTesla
b9c037384eaa82706baf7c3cd5e1550fe9ad24083edeb00e55d9da8198ea6ee3
AgentTesla
c158b8ed8c9a0221bfeb3dea8d026d5bb9bade9ecfd19191ada59c51c8eb4089
AgentTesla
c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
AgentTesla
e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
AgentTesla
f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557
AgentTesla
+ 6'169 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-sgx5t35nae/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img dd6113c9a138aaf824b9fd5b883cae60f926a68ce94927d805e631357891de22

AgentTesla

Executable exe 194fe792044279124a5e298a697897e99df0dd83f7c51d6bee295b447810531d

(this sample)

  
Dropped by
MD5 609d3ec67731110ac1cc83b21a6f0849
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 dd6113c9a138aaf824b9fd5b883cae60f926a68ce94927d805e631357891de22

Comments