MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37c13fe1e55fbaa196cc1bb6ab1c2e30a326298687cd434f0b116c5ccb12a47e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37c13fe1e55fbaa196cc1bb6ab1c2e30a326298687cd434f0b116c5ccb12a47e
SHA3-384 hash: 52a5603dcc57c645dcf7f3af5bc70be3b2d5ec0bc2fb845a0d6a9ed512411147a4872c78869e08c84b96bf6250cd0569
SHA1 hash: a1b57e69e1053c33e17506f2823d1b90790f068e
MD5 hash: 1038689741db7a8136882269676100bd
humanhash: michigan-hot-juliet-cold
File name:gyrcnt.jpg
Download: download sample
Signature AgentTesla
Create hunting rule
File size:674'816 bytes
First seen:2020-07-28 13:22:46 UTC
Last seen:2020-07-28 14:07:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:jkzwuh8BSfN7Bv16pDBAp+ze4yfcpLASaJfuAGwGevchgBWMKs+/WS4:jYwutfN7BvQb5/1BaJEfhga
Threatray 10'696 similar samples on MalwareBazaar
TLSH DDE449797AC26406D43E1A35C5B89ED037B2F6472F02C70F29EA175C6F036AB771609A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: out4-75.antispamcloud.com
Sending IP: 185.201.19.75
From: roshayati@rahim-co.com
Subject: PO-RAHIM 1101134
Attachment: PO-RAHIM 1101134.xls

AgentTesla payload URL:
https://a.uguu.se/gyrcnt.jpg

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/33678/
Detection(s):
SecuriteInfo.com.Heur.MSIL.Pretoria.1.6348.6954.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Running batch commands
Launching a process
Creating a file
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
69 / 100
Link:
https://www.joesandbox.com/analysis/400385
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files to the user root directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 252544 Sample: gyrcnt.jpg Startdate: 28/07/2020 Architecture: WINDOWS Score: 69 39 Antivirus / Scanner detection for submitted sample 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected AgentTesla 2->43 45 .NET source code contains very large array initializations 2->45 7 gyrcnt.exe 7 2->7         started        11 pcalua.exe 1 1 2->11         started        13 pcalua.exe 1 2->13         started        15 wuapihost.exe 2->15         started        process3 file4 27 C:\Users\user\bsm.exe, PE32 7->27 dropped 29 C:\Users\user\bsm.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\Users\user\AppData\...\gyrcnt.exe.log, ASCII 7->31 dropped 33 C:\Users\user\AppData\...\InstallUtil.exe, PE32 7->33 dropped 49 Drops PE files to the user root directory 7->49 17 bsm.exe 2 7->17         started        20 cmd.exe 1 7->20         started        signatures5 process6 signatures7 35 Antivirus detection for dropped file 17->35 37 Multi AV Scanner detection for dropped file 17->37 22 reg.exe 1 1 20->22         started        25 conhost.exe 20->25         started        process8 signatures9 47 Creates an autostart registry key pointing to binary in C:\Windows 22->47
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/37c13fe1e55fbaa196cc1bb6ab1c2e30a326298687cd434f0b116c5ccb12a47e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 13:24:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7at7ypfl65kdfwmdo3kwhbogcrsmkmgq7gugtylcfwfzsysur7a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3c267f259097c5786ddcb5c74ec6410267d465976259d841b988271b7474906c
AgentTesla
3f17b1407dd6b3febc9c19770d1252a7028971382c85a2b9320e416801b2f904
AgentTesla
44096c1493b07b6097e73099250d28081e1729e2181420e90b5913030c9687b2
AgentTesla
72bcbcfab861501c3778d871856d1e80169b0401a20064a52395c19f0cd93f8e
AgentTesla
86ed0ebbd24ad4c94834ea45d9af009a08738c1341b95ca0d35a59ffdc726de7
AgentTesla
9dda846870b687794890a95e4532f7886dcf61d6bfcd4cbc2ddeb306abc22311
AgentTesla
a132044c5acdf6901718ff3e7b6cee80b0d976f32d8876b2352b08d316feacf7
AgentTesla
c2be2f9a3561ac1145ac0711574c30064e14ec9d62e916b700f75cc33b77d154
AgentTesla
e6a9bbee2b3b1dec06bfcddd17711777d7d14171e9c180a7310f6bb9cabf6879
AgentTesla
ec6afc29beafb4093f0aca9fa00e1c3097dac94baee4801eebc5043de4556781
AgentTesla
+ 10'686 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200728-sn86tp1xbx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37c13fe1e55fbaa196cc1bb6ab1c2e30a326298687cd434f0b116c5ccb12a47e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xls abd8da993d03560322439aeb5bf6947cba72c75b06fe54440fca9065ed5e4896

AgentTesla

Executable exe 37c13fe1e55fbaa196cc1bb6ab1c2e30a326298687cd434f0b116c5ccb12a47e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/420673/
  
Dropped by
MD5 75ae24f5561685253732d7eca8567058
  
Dropped by
SHA256 abd8da993d03560322439aeb5bf6947cba72c75b06fe54440fca9065ed5e4896
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/33678/
  
URLhaus
https://urlhaus.abuse.ch/url/421718/

Comments