MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526
SHA3-384 hash: 0de22b99e7a00b198a0f0f59fa7e6bf17cbbb8ddbf36dffa2a07de4f8a7756a36ce113bcd1108299d0d50e7dd95bbca9
SHA1 hash: 9af662131c1f871983d798de1bc0f52951fdb8e7
MD5 hash: 026e5f23dbbca02bf5c2432796016323
humanhash: april-may-coffee-edward
File name:AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00..exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:990'720 bytes
First seen:2021-02-24 07:04:18 UTC
Last seen:2021-02-26 03:29:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:nLCsG16KLpRYCu6FCM5I/lYCb61Zvch7hseeW5:nL1ZCRXudMycZkh77
Threatray 10'897 similar samples on MalwareBazaar
TLSH 8B2512E23B615B1DC86707B403519A9C9B642F3B0A9BD01DADC4B6D77072F8B291F913
Reporter abuse_ch
Tags:AgentTesla Akbank exe geo TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: akbank.com
Sending IP: 103.151.122.27
From: "Ahmet Tuğçe" <bizeulasin2@akbank.com>
Subject: AKBANK, SWIFT ODEME EMRI-USD-78,000.00 MT 103-SINGLE CUSTOMER CREDIT TRANSFER
Attachment: AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00.lzh (contains "AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00..exe")

AgentTesla SMTP exfil server:
server122.web-hosting.com:587

Intelligence

File Origin
# of uploads :
5
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00..exe
Verdict:
Malicious activity
Analysis date:
2021-02-24 07:17:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/84f39885-72ab-49e1-b57f-7ff15be2aaec

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118865/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42850.30949.7300.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/616256
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 357135 Sample: AKBANK, MT 103 SWIFT ODEME ... Startdate: 24/02/2021 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Multi AV Scanner detection for dropped file 2->31 33 Sigma detected: Scheduled temp file as task from temp location 2->33 35 7 other signatures 2->35 7 AKBANK, MT 103 SWIFT ODEME EMRI-USD-78,000.00..exe 6 2->7         started        process3 file4 21 C:\Users\user\AppData\Roaming\pcXENVtlb.exe, PE32 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp3DF2.tmp, XML 7->23 dropped 25 AKBANK, MT 103 SWI...-78,000.00..exe.log, ASCII 7->25 dropped 37 Writes to foreign memory regions 7->37 39 Injects a PE file into a foreign processes 7->39 11 RegSvcs.exe 2 7->11         started        15 RegSvcs.exe 7->15         started        17 schtasks.exe 1 7->17         started        signatures5 process6 dnsIp7 27 server122.web-hosting.com 198.54.114.191, 49730, 587 NAMECHEAP-NETUS United States 11->27 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->41 43 Tries to steal Mail credentials (via file access) 11->43 45 Tries to harvest and steal ftp login credentials 11->45 51 2 other signatures 11->51 47 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->47 49 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->49 19 conhost.exe 17->19         started        signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 03:01:54 UTC
AV detection:
7 of 45 (15.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gs4ftd7jlrolikihl3zp4l4si3nb7eajvd7f4426232bltrosuta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
24f9b41f0801760c1baaa6d3958bfd6e48c7dcda2720a80a5e71638da70d7ff2
AgentTesla
351385e50606d92008281d316fec5ab6799fb563cd45eca3b1fd9b6e3128afbc
AgentTesla
436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5
AgentTesla
64cf6c6d753b20e2a4d9ffc5f39706602e80a90c8ed8efce79d7e6535805302f
AgentTesla
6932cd91548a70814291bd9793e7e048526cc4f183e5aa3c9ca8ba9b243a8474
AgentTesla
7c6a987b9a63992f13adc130b38aee07d79d8786178c9cf339915112a28a7a6f
AgentTesla
a52c72aa195562b2f469e6dbc1e2e7534aec440d4674cedb788f3800286ecbbf
AgentTesla
c1f797506aa00305f7d7df4ef9933904a58c03c7da3f5a20f9087279ea71a1d6
AgentTesla
e7aa669d895afe3d45e3b096f3f1b5d0d36c0f441175b677fe4541733f5cb61c
AgentTesla
e9839355693536c3d416824964cdabce19938fe1bae7109567cf6d95af6f5ff3
AgentTesla
+ 10'887 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210224-exfwl56n8n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
a4e01c1b03904c020e48cc36443ebf31d7e04f53a57d9c5ac0daccd75caff2f7
MD5 hash:
1352ff3efafc0ac9e9ab2cd08eebed2b
SHA1 hash:
acaf8d47167976790e3df88bd63ed30b0d32d49e
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/ad1a2070-6bc1-4903-ba1a-804f2dcbcffd/
Parent samples :
7c6a987b9a63992f13adc130b38aee07d79d8786178c9cf339915112a28a7a6f
436c0c803cf1ed56a09ce4ba60472e15082fccc5d84e587aebbbb159d487feb5
e9839355693536c3d416824964cdabce19938fe1bae7109567cf6d95af6f5ff3
6932cd91548a70814291bd9793e7e048526cc4f183e5aa3c9ca8ba9b243a8474
64cf6c6d753b20e2a4d9ffc5f39706602e80a90c8ed8efce79d7e6535805302f
e7aa669d895afe3d45e3b096f3f1b5d0d36c0f441175b677fe4541733f5cb61c
34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526
f317e0dc1f74b0e49135d97d78c57a088121a9e70644e0eb3092489b9b753240
SH256 hash:
0ec53b2a962ac4f6c53838c5bea709d4e059be5ebf13e40b225cefa2dce6f870
MD5 hash:
0cad924560065888e9fd3dbab60f1eeb
SHA1 hash:
6efc35c261cf0cafbc6c7e7e20f130d1e25715d2
Link:
https://www.unpac.me/results/ad1a2070-6bc1-4903-ba1a-804f2dcbcffd/
SH256 hash:
f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671
MD5 hash:
f984a71581f6da5732110be2a569a392
SHA1 hash:
10de05b6b35fc5dbc00c42d59a4b850bcaae01e6
Link:
https://www.unpac.me/results/ad1a2070-6bc1-4903-ba1a-804f2dcbcffd/
SH256 hash:
34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526
MD5 hash:
026e5f23dbbca02bf5c2432796016323
SHA1 hash:
9af662131c1f871983d798de1bc0f52951fdb8e7
Link:
https://www.unpac.me/results/ad1a2070-6bc1-4903-ba1a-804f2dcbcffd/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_extracted_bin
Create hunting rule
Author:James_inthe_box
Description:AgentTesla extracted
Rule name:AgentTesla_mod_tough_bin
Create hunting rule
Author:James_inthe_box
Reference:https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/
Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:agent_tesla_2019
Create hunting rule
Author:jeFF0Falltrades
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:MALWARE_Win_AgentTeslaV2
Create hunting rule
Author:ditekSHen
Description:AgenetTesla Type 2 Keylogger payload
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

lzh 77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d

AgentTesla

Executable exe 34b8598fe95c5cb429075ef2fe2f9246da1f9009a8fe5e735ed6f415ce2e9526

(this sample)

  
Dropped by
MD5 5a48812ecdde2d3ee35e0ba8d5b363b4
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 77ad355120b6b70b8d9b3ff2638fe0bee9f941242519d81aeb1f71a53d17470d
Cape
Cape
https://www.capesandbox.com/analysis/118865/

Comments