MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9
SHA3-384 hash: 814fc82ce6fceb0db50a1569001cf3e266077541405baef5de8c2df97e081ac762c3efeb038cbb712ee649fa16723660
SHA1 hash: 9c66417c5aae88e038ca0dc6749251dbae723d6d
MD5 hash: e06a4f3a4fdba17455b15b6cfb10e21a
humanhash: nebraska-east-beer-potato
File name:INVOICE PACKING LIST-80186.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:887'296 bytes
First seen:2021-01-06 07:17:57 UTC
Last seen:2021-01-06 08:34:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:fJm541zUIivNc8MwPnvSseeNH4y4RikTnebk1eh9jUDD3kSvhHW+3hsxbDNXUbAg:U58UIivNc8MwvLeeNH4XPnCkejAkIhf
Threatray 2'072 similar samples on MalwareBazaar
TLSH 7415189D365076DFC867C9729A981C64FBA074BA830BC273906315EDAA4D997CF340F2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "Sales1" <info@noc.oil.gov.iq>
Subject: INVOICE & PACKING LIST-80186
Attachment: INVOICE PACKING LIST-80186.gz (contains "INVOICE PACKING LIST-80186.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INVOICE PACKING LIST-80186.exe
Verdict:
Malicious activity
Analysis date:
2021-01-06 07:28:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e8f2ca09-5eff-495e-a075-91a04d51b3ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/110678/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36011452.26929.9781.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/574837
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 07:18:06 UTC
AV detection:
17 of 44 (38.64%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eryfrres7bdxef5wkhm24az3q7qaphkt2aeju6czbpfdqeu6k7eq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
20caa9bbab7ef41b3766a4fc9c1690b84b9425a1105eb563673a5000f02936b3
AgentTesla
47fc6e8b1fcbd7a6b0955ffeb4a6b995b50964da04b50f8e52ef5e770ec68840
AgentTesla
5952cc403a58eab272b199a6f39c35bfadf8feeafbadc1a3d30a68e01e93b7ae
AgentTesla
69536001b44238c3b5dd5100d6a198a0b192bdf2760d5272694a030d9adbe09d
AgentTesla
6f47301c8691d7f68ccf71931b8e2664fad0720d1f4d01f4bfda35cd1a076bd1
AgentTesla
8fcfe841647c5f4d3f10b59fa63b2e2dff841b4c5c39cbfa828146281e49ad77
AgentTesla
aeb333f991b9db4140b8c84c574510ec6571b9b5e8d8d2fcc631098b36a79f49
AgentTesla
c05e310c646407fa733712a98c822a5416ca1124322429d8d2a90966e909a6b5
AgentTesla
c1e775844ae65d163fef7ec92e2d48ab4fd36ec5412999a5cba1c85ef0edd105
AgentTesla
f5a368e8e1fd840abbe075db0a30756ca6297af3c9d3a8f9e1998f57e1204cbd
AgentTesla
+ 2'062 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/210106-f5yd2hs6qe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9
MD5 hash:
e06a4f3a4fdba17455b15b6cfb10e21a
SHA1 hash:
9c66417c5aae88e038ca0dc6749251dbae723d6d
Link:
https://www.unpac.me/results/d1971dd7-925f-4103-aa17-2113a9a4f3a4/
SH256 hash:
0759e55dae527464c28d1b84eb6ad517dc9faf34a5ad10d55f652cb410a28f21
MD5 hash:
0ec82c5999a9391b7628d336f567b104
SHA1 hash:
0bd5978b480d87c0227a4bc7d12a761ae870d1aa
Link:
https://www.unpac.me/results/d1971dd7-925f-4103-aa17-2113a9a4f3a4/
SH256 hash:
dbcd004460b95b8b867dbb30c549feb5716883bf75cdf9ad9756dd0aadc3ece0
MD5 hash:
a76bd8e7d010e386c1530d8bbf3687ef
SHA1 hash:
4c376dbbcb2d0a68f98fcfb7127b83d3a357771d
Link:
https://www.unpac.me/results/d1971dd7-925f-4103-aa17-2113a9a4f3a4/
SH256 hash:
b32c4d43286f34623ed3555d48e1b4451fbf9d7c85857036b965f522f74af97a
MD5 hash:
3d95124c9c47fcd142eca459c8226787
SHA1 hash:
fcbc5c8a09ae65e4d41b2682c789111e077a350f
Link:
https://www.unpac.me/results/d1971dd7-925f-4103-aa17-2113a9a4f3a4/
SH256 hash:
f6047bbe1209f0cd802f9133ace80274ae84b829394933fe3a4516be28b70946
MD5 hash:
1477efdb6e7fbcc0d9d8b6b5e0291c4b
SHA1 hash:
fe4f988c98e6f9c664fd2d1e6ef701089b5dea98
Link:
https://www.unpac.me/results/d1971dd7-925f-4103-aa17-2113a9a4f3a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b4a1574e912a910d6a3c9b729f32a77fd6a653d7bddeca194fafdb54368b2562

AgentTesla

Executable exe 247058c492f8477217b651d9ae033b87e0079d53d0089a78590bca38129e57c9

(this sample)

  
Dropped by
MD5 2384a493ae5f99cf68acfafa23066651
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b4a1574e912a910d6a3c9b729f32a77fd6a653d7bddeca194fafdb54368b2562
Cape
Cape
https://www.capesandbox.com/analysis/110678/

Comments