MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9
SHA3-384 hash: 721575fff63800c3e1f860a6e7443f99bd9ff21b02d89f132c57e981986224e9eadd858f7b974d2c6c58f0451ca73229
SHA1 hash: bffe463cb800e99e916602a7e58950325c444bdf
MD5 hash: 3ad3b5f96c243434e6c17a150b6e4db1
humanhash: eighteen-west-berlin-seventeen
File name:DHL Shipment document AWB 2375690032178_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:547'840 bytes
First seen:2020-10-08 14:05:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:ISi5Za+LXdkcmt21Ru6dT5WRYFtaXyU3nkHLv2n3V6+/WO+LlrDuM0:ISivlLmcmILdT5WCCX6vA3cgIlu
Threatray 184 similar samples on MalwareBazaar
TLSH 86C45B6B6892446CCD1C87B19CB249F0B9A73FCE2E73490D65CD72180E33A57771A26E
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.huitescicom.pw
Sending IP: 104.168.184.88
From: DHL Customer Service Delivery <office@huitescicom.pw>
Subject: Oznámení o doručení zásilky do DHL AWB: 2375690032178
Attachment: DHL Shipment document AWB 2375690032178_PDF.img (contains "DHL Shipment document AWB 2375690032178_PDF.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69282/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a window
Creating a file
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/485614
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 09:37:12 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ei6drpqcfpzx54sdkvsdr3guokxgpo5un7hq47he5iyxgjqbihuq._file
Verdict:
unknown
Similar samples:
205522a02f43a8477a1ed81ea1dff4f5b914afbc01f68ac082e5bf76d73fe8b2
AgentTesla
400c038450745568175dcd762403a0896ca44e3c0e4113ed08ea9fe9a992be0d
AgentTesla
5e18a7e53e246b740a583555514158a7ec3dfa0b36944b6d8b76fcbc9668ec91
AgentTesla
6badf55361de08f484122fb041fcad31e29a448614f1b315d66a3f58ad9a50b9
AgentTesla
8fc52ab78b091873ee351be8fed2c5026d9fdae75ddfe910ea2b179843ca0c3f
AgentTesla
b24e43f00bbbd88fea2b129c08915d84b5a7643326ff630a0cf013cb2105749c
AgentTesla
b796ebc23a355b8fbd29552b2ff7142f09617c25a30a33d5a92626f69e337d48
AgentTesla
c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
AgentTesla
ccd1a40e599ad9f364ca70ef3d02b4850901fdeaddb5c9a4b66405e2bccc9ad2
AgentTesla
e7adb9ddc612bc2bbc52cc809b0a7b90c6f28f0b9df4fa767dccdab4d1d91c50
AgentTesla
+ 174 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201008-cncntrhcex/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Unpacked files
SH256 hash:
223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9
MD5 hash:
3ad3b5f96c243434e6c17a150b6e4db1
SHA1 hash:
bffe463cb800e99e916602a7e58950325c444bdf
Link:
https://www.unpac.me/results/f0114016-0564-4e5a-b0c0-0de7a3c2d9f6/
SH256 hash:
c59ec421683032aa70f2699dd1f81dd101c0518002ea24db9cb9dfd42b682334
MD5 hash:
7e3e10e1e124301578869e5c13d5ca10
SHA1 hash:
06621e58801645c9a0e9a76350d76314fb19de86
Link:
https://www.unpac.me/results/f0114016-0564-4e5a-b0c0-0de7a3c2d9f6/
SH256 hash:
30140c3bf5874d7d184b15513016f9de1524ae95a5efe9a1cb15bad6d6936d64
MD5 hash:
03847d82611bc6461cbb99ca768828f1
SHA1 hash:
39859a3fd3326520dfd1ed10456bb227933a8871
Link:
https://www.unpac.me/results/f0114016-0564-4e5a-b0c0-0de7a3c2d9f6/
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
Link:
https://www.unpac.me/results/f0114016-0564-4e5a-b0c0-0de7a3c2d9f6/
Parent samples :
afa2f55e149097f9b250142bbfd94d9d56d10649c96adb079fdb0dfdac7c6660
69e2ae11e1b5cbe120bf02301191a1cf05e87fc09b09d63bd782abbf3615d05d
0b778873c94f6bc89a40294c0e85a38ab82509260cd2a2e8b73d00c5c90e8757
7ddfa6f44a60f4b894321f6977f8121cfb371c3c61ac872c58ba61fd5ee13deb
SH256 hash:
e3f3f21f1da73f127615d0ce7f20b1159facd9b5015ef223de73dddbcdf1f59a
MD5 hash:
7a4f8f06291d4cff66c36c4963e2d0e6
SHA1 hash:
dfe8b19e175fb63bd891664e11e9f7fa646f4bf1
Link:
https://www.unpac.me/results/f0114016-0564-4e5a-b0c0-0de7a3c2d9f6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img a21779f618e90492754125db9f8b77e9e2ffdc5c164f704e2dadeb657ef81a42

AgentTesla

Executable exe 223c38be022bf37ef243556438ecd472ae67bbb46fcf0e7ce4ea3173260141e9

(this sample)

  
Dropped by
MD5 3411024289af7a1938370d5dedd6b932
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69282/
  
Dropped by
SHA256 a21779f618e90492754125db9f8b77e9e2ffdc5c164f704e2dadeb657ef81a42

Comments