MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 199b6a1b2319f9987848125e753cbb9d8457ad2364724857c0433e770ab5106e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 199b6a1b2319f9987848125e753cbb9d8457ad2364724857c0433e770ab5106e
SHA3-384 hash: a54f1208deeffba6f93ec066c05c376dea9379c00f3b267edcb1711b26737f35e6eb631a4d267ed03a16088df730e4f4
SHA1 hash: 61b0f4b66dc745e41f3135c3cec8075b6acfd1f5
MD5 hash: 722f97d7c1554f480f06c0b51debbaf6
humanhash: oscar-beer-glucose-asparagus
File name:order pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'570'816 bytes
First seen:2020-04-14 22:29:24 UTC
Last seen:2020-04-15 07:32:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:SAHnh+eWsN3skA4RV1Hom2KXSmdarhdnCwV3B+2xUkylwAXWrpr+UXf1XwbrY5:Vh+ZkldoPKi2arTCwdTxUiAXWV1tXSi
Threatray 11'107 similar samples on MalwareBazaar
TLSH 4175DF0277D5C036FFAB92739B6AF20596BC79254123852F13981DB9BC701B2263E763
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-03-23 00:59:51 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
28 of 30 (93.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dgnwugzddh4zq6cicjphkpf3twcfpljdmrzeqv6aim7hocvvcbxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
23ef17c8a9fbcb6c35549aff9263566bec6e3fbc61e6bdfb9715d2595a1ee003
AgentTesla
393d9a4808a0379b8cd5a2af21d335d8b542a597ff60c2f79a81077eaa9606c6
AgentTesla
3afb002ecadb7a5826ecf82f63063b40270f6f78e812abbcb3d9b914ae67d1a9
AgentTesla
788439bb46a147272e39cdd6a8a8ecdc68dbb3317e4d058526d6feda09d64613
AgentTesla
a38f26190f844b13a2bbb8cbecf4b57bf109f78b665e34b8164882d8d2cdb6ee
AgentTesla
b254d7faa603b46c4c63f6d1f88d65767fb80638a000967fe527b9572b956e35
AgentTesla
bcc007773b48459b0b8b0fc4c47d621f65a178d297517486f78aec91d5dc1a87
AgentTesla
c1f0ba6302099b8f7ef1ce28a333764efdd308cccc761ba4fcef2af386f13090
AgentTesla
e0304dda8c6bcd6e6987441aab472a1bdaf17efb0ef9906b15c33fb59042e257
AgentTesla
e942c853f791a2ebd37ae59344bf8878d9a02cdcb83848a68876c49497c642d2
AgentTesla
+ 11'097 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 199b6a1b2319f9987848125e753cbb9d8457ad2364724857c0433e770ab5106e

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments