MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f
SHA3-384 hash: 7d20feefc64f7d28dcdf592a238cf9d836e139ebf9c7eb3dc7d12c2de49ea87e258ea2516e9bb7549fa7a78533243538
SHA1 hash: 85d9dd8d34eb8df8202980aba5b81ca551ac03df
MD5 hash: 2f3327cdf5fa7e168dfcdd61a72a2de0
humanhash: illinois-three-william-three
File name:BBVA-Giro-00129283009.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:611'840 bytes
First seen:2020-11-05 18:53:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:OQuWCY82DdgZ43oQnFSmBHSvkImfrvo50BPX/erqhKXIfi:JIwDdW43TSmwctg540qcXIfi
Threatray 988 similar samples on MalwareBazaar
TLSH 58D4D03CA2583F95E13EA37891ED151047F2A14AD331EACE7DE440CF16F6EA1A677A01
Reporter abuse_ch
Tags:AgentTesla BBVA ESP exe geo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.ga
Sending IP: 111.90.144.72
From: Contabilidad - Borrego <contabillidad@agroquimicosborrego.es>
Subject: Autorización giros bancarios
Attachment: BBVA-Giro-00129283009.img (contains "BBVA-Giro-00129283009.exe")

AgentTesla SMTP exfil server:
mail.chefoowork.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83528/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 18:55:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3t56xcr362rharnzle4ltobxletvk4jyyzk27pp56g6vh4t7nhq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01330ada2211171d1bb5db977363a94cea239c455ea8c2fabea401a29b1c8143
AgentTesla
090b379ffd22f27e1070c2f56d6a7833a6f04451cd4b065571dd2e04e62faac5
AgentTesla
1228ba2604d0a579845a1dfdc24e4923c184e1295d2af972063d76d64b33ef99
AgentTesla
20dbea65f9ea5d713ead877a8fdca2bb606af820520ea99fafcef39fc7652ce2
AgentTesla
2533bccd55634d0883662979a1ffef4f7d990f7153c28096befa93aee34beded
AgentTesla
431c9f8b4b58782d7f9ebeccb1b3a18357667fef8293571cf01aa72f98720df2
AgentTesla
47ed9a694769d7cb9419f9a7250c67d109567589767862e20669be81536c60ea
AgentTesla
6609cf9b0aefabaaf1bccc04237e6ff32315960166bf4aa2ff5372cfb51c80d3
AgentTesla
c3e25836dbdb6fc57f756a3ac537338e4806d45a602c4705c0a4ee32861aba0c
AgentTesla
e998f0cbd6aef5d5efa2405caccf5594bdff5e18383a8aeccc26caa6b49a1ee0
AgentTesla
+ 978 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201105-e3pfdj88es/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f
MD5 hash:
2f3327cdf5fa7e168dfcdd61a72a2de0
SHA1 hash:
85d9dd8d34eb8df8202980aba5b81ca551ac03df
Link:
https://www.unpac.me/results/6b3d72fb-d04d-4037-9ee2-40aaeef1ea98/
SH256 hash:
1a467731ea3a80bbd386f15082220d9f3e749637253c2f42eec19940b9e183c0
MD5 hash:
1deef47a89c37def1dadca392e525950
SHA1 hash:
2dd4271b8a58ac5033b7140e3ce15980807aa8db
Link:
https://www.unpac.me/results/6b3d72fb-d04d-4037-9ee2-40aaeef1ea98/
SH256 hash:
c3cd400d649ecfdff9919e44f2c6b60d0a3a1cc89b45d70981e2027330bcc255
MD5 hash:
035ec6c566d736dd62947f182bbf5233
SHA1 hash:
c27333b08f293e1716158a5719f3eabac66e60e7
Link:
https://www.unpac.me/results/6b3d72fb-d04d-4037-9ee2-40aaeef1ea98/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/6b3d72fb-d04d-4037-9ee2-40aaeef1ea98/
SH256 hash:
8ee4e9f6838d15b7d7996c561e4895e7aee6231606d0f714dcec78fb92a46982
MD5 hash:
fbbf38db587fc1206c408ac935583e7b
SHA1 hash:
e9d7ca430bc69ee0d75f3f949a5b7112e2274ea4
Link:
https://www.unpac.me/results/6b3d72fb-d04d-4037-9ee2-40aaeef1ea98/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 0795661bab67528dd92d74fe4cbcd0dfe229a156e35b4766279e92c7bcdbf314

AgentTesla

Executable exe 2ee7df5c51dfb513822dcac9c5cdc1bac93aab89c632ad7defef8dea9f93fb4f

(this sample)

  
Dropped by
MD5 61659ac259d10ae752c22d6436ee6d7d
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 0795661bab67528dd92d74fe4cbcd0dfe229a156e35b4766279e92c7bcdbf314
Cape
Cape
https://www.capesandbox.com/analysis/83528/

Comments