MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289
SHA3-384 hash: 5dfa0496543303516c9ae71fe4a41a8f7bcb2c5b589f2fd1e94ea4082a2a6b1f403909bd88a7233936d4332a1218a062
SHA1 hash: 3b7d280fe1709ea898c780ec270f8bc69b4a35c4
MD5 hash: bac2f1cca0617a0383c59d806b2871e1
humanhash: two-alpha-autumn-king
File name:2097508E2-2-1C358609BA01.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'784 bytes
First seen:2020-10-16 13:48:56 UTC
Last seen:2020-10-16 15:15:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bd0ccfffe29beda9bfd332e673d3d4c7 (3 x AgentTesla, 2 x Matiex, 1 x Formbook)
ssdeep 12288:Uy0R1oe3nSF94nwrIQi899F713Wm07wVMf:Uyq1oe3n5D8GlXf
TLSH 66B4AE61B304ECF2E017253948B5F960142BBE766E2F444F3746372AAD327826277D9B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.209
From: emendez@farwestcorrosion.com
Subject: PURCHASE ORDER ( INVOICE) URGENT!!!
Attachment: 2097508E2-2-1C358609BA01.zip (contains "2097508E2-2-1C358609BA01.exe")

AgentTesla SMTP exfil server:
pro40.emailserver.vn:587

AgentTesla SMTP exfil email address:
hieuhn@itpc.gov.vn

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72073/
Detection(s):
SecuriteInfo.com.ArtemisBAC2F1CCA061.18071.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a UDP request
Creating a window
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493740
Signature
.NET source code contains very large array initializations
Found malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 04:42:48 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkwk3nrk3h3x2ey5rvadsc57jjxpruhsmnntrownw7veha3jykeq._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201016-eev1k2q8w2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289
MD5 hash:
bac2f1cca0617a0383c59d806b2871e1
SHA1 hash:
3b7d280fe1709ea898c780ec270f8bc69b4a35c4
Link:
https://www.unpac.me/results/a67e9677-cf30-4d3e-96ab-f733094c861c/
SH256 hash:
fc8a4473b1e2d0a9f42aac90fb7a2f5220e53693f31cca11ec5045d287d2adef
MD5 hash:
a0dc74ed9347964c7f2bbcf49ad10732
SHA1 hash:
626f571851a72bd85368f6cd0178d706a0adbbf4
Link:
https://www.unpac.me/results/a67e9677-cf30-4d3e-96ab-f733094c861c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4ee1a1b6151ef00422235c2c7ba9e062bd780521ebd03fb17a2409e0dc23b70b

AgentTesla

Executable exe 2aacadb62ad9f77d131d8d40390bbf4a6ef8d0f2635b38bacdb7ea438369c289

(this sample)

  
Dropped by
MD5 331b4f611e3b84fb033db83e6042ed9c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72073/
  
Dropped by
SHA256 4ee1a1b6151ef00422235c2c7ba9e062bd780521ebd03fb17a2409e0dc23b70b

Comments