MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff
SHA3-384 hash: 722734ca74cdfbbec77817f1368e3ad9e6e8b4ac0121a4cd8001b2224924129ee8248d184906ac1f8481b7341b8c8cfe
SHA1 hash: 2c114090bff796dea86a2bf9b4801d7e701a616c
MD5 hash: ab3090feea21d2817c6afdadf06fe6a4
humanhash: east-florida-carolina-ohio
File name:Purchase_order_Project_1489938202.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:640'512 bytes
First seen:2020-10-05 11:38:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep 12288:dsQ5xGH4VY98FLK2JI1PBrn3ziGyWqxw9CtoSjIOQ60d:a8GH4TFenz3ziXFw0toSjIOQ
Threatray 305 similar samples on MalwareBazaar
TLSH CDD4F11072E85B11D8F6A7FA5934C11443BA3A463673E39C8CE2B1DE2DB5F104A25F6B
Reporter abuse_ch
Tags:AgentTesla bat


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sellerbulknewspoint.live
Sending IP: 202.75.32.30
From: Sam <info@sellerbulknewspoint.live>
Reply-To: charrntide6@gmail.com
Subject: Purchase Order-Urgent!!!
Attachment: Purchase_order_Project_1489938202.img (contains "Purchase_order_Project_1489938202.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68159/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/481319
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 06:07:32 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eddeetrvhkpegzyixoqqe4iiitsszcw2mkwzdzw6mvby5yrt7l7q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
135b8460366d8e5da1ee0293afd0087133280f0f9084a5562b8726d13677d12d
AgentTesla
1e5fd179246b957c72ee164cbd3a0c20dd824c5af02f85b94a59a7537859a82b
AgentTesla
880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f
AgentTesla
ba7b4dfc9852ed43efb9b79e6f9586f79b1cef29c7f9d793c3026e85bd1cacb6
AgentTesla
bf56f62cbc583924d71c51afea9546cbfd6dafafe877553a3d1ca37a25d34767
AgentTesla
ccdf4a4de46d510c72b7ccd6036af45ec3782f6a683e0534eab1a294c34ffcf3
AgentTesla
e3d0c7364e4c4098ca40e5a9f117a94b475243db12416b6e3fdfc22ef2d7c92a
AgentTesla
e8e343cbb5ec9cf1c0d2d4ce34773c03b18cbdc29811acbee054b0731660ad02
AgentTesla
f23c845c6c2450e632e8894be99fe3eb8a6a42eedc749c593431665c18e37d03
AgentTesla
fa28414beb5467b5f805e2a83eb76a5face95c36040bd3edd1bd791ee8ef48d1
AgentTesla
+ 295 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201005-jc1nhtbwje/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff
MD5 hash:
ab3090feea21d2817c6afdadf06fe6a4
SHA1 hash:
2c114090bff796dea86a2bf9b4801d7e701a616c
Link:
https://www.unpac.me/results/eb4ea0ea-aa7a-4ef1-9670-dc62e84439ad/
SH256 hash:
1993ee2071f9d17b37b136f15867b37417f5c168f1e71a253cc5e63caed40a0a
MD5 hash:
5f7f065c9dd2cec91a1ef9cc3a871c34
SHA1 hash:
22e2e56628410aa6ae218f948bcf899363f49f22
Link:
https://www.unpac.me/results/eb4ea0ea-aa7a-4ef1-9670-dc62e84439ad/
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/eb4ea0ea-aa7a-4ef1-9670-dc62e84439ad/
SH256 hash:
e9863590acca1761cb2593591dd1a8081f1b1724d280505ecfe1d391356c7031
MD5 hash:
d393a19cdfb0d4f4b2a0a5117aec12c7
SHA1 hash:
836269912749d9bc80395ac2bde6b6e90d288a16
Link:
https://www.unpac.me/results/eb4ea0ea-aa7a-4ef1-9670-dc62e84439ad/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d

AgentTesla

Executable exe 20c6424e353a9e436708bba102710844e52c8ada62ad91e6de65438ee233faff

(this sample)

  
Dropped by
MD5 b49b6db07fb1a40bd3dae0f96e666be7
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68159/
  
Dropped by
SHA256 f8df8c2016f746bc386cd7c8550bb9eef1b2a5349960fa33dfe71a6787da828d

Comments