MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b02adbda158a35f586aa1f17780dc8d5cd0404c864a16b8c6b5a8f2b02363f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b02adbda158a35f586aa1f17780dc8d5cd0404c864a16b8c6b5a8f2b02363f9
SHA3-384 hash: 57116cf4d68e12764113a78d494e7a403b629272391f0714ec90d0c2492731e1d1883e6857b0195b342cb5e152a98f56
SHA1 hash: e9dfeb9aa463cca85cc8d86356b85f5cf1c4f1cd
MD5 hash: fc0aba83fdf2d60bc949f5185238c480
humanhash: connecticut-shade-twelve-cardinal
File name:IMG_29096757678909876567890_109834554.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:494'080 bytes
First seen:2020-11-18 12:04:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d1ac88a064c1f440665011c239216056 (3 x AgentTesla, 1 x Formbook, 1 x AsyncRAT)
ssdeep 12288:wArOtV1ZQwTBJ+291E7UiTxHZAlY8csB5V1:wArOtFtTb+E1WP9HO5V1
TLSH F7B402347090C0B3C25321B980E9D7B16A3DB576173566C7BBD81BBD4F352E69B3228A
Reporter abuse_ch
Tags:AgentTesla ESP exe geo Hostwinds


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-799617.hostwindsdns.com
Sending IP: 192.236.146.33
From: cuentas <receivable@chief-container.icu>
Subject: Re: Confirmación de aviso de pago
Attachment: IMG_29096757678909876567890_109834554.IMG (contains "IMG_29096757678909876567890_109834554.exe")

AgentTesla SMTP exfil server:
mail.chenklins.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/540975
Signature
Found malware configuration
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: MSBuild connects to smtp port
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b02adbda158a35f586aa1f17780dc8d5cd0404c864a16b8c6b5a8f2b02363f9/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 12:05:05 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hmbk3pnblcrv6wdkuhyxpag4rvonaqcmqzfbnoggwwupfmbdmp4q._file
Verdict:
suspicious
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201118-2w6pndnd62/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
3b02adbda158a35f586aa1f17780dc8d5cd0404c864a16b8c6b5a8f2b02363f9
MD5 hash:
fc0aba83fdf2d60bc949f5185238c480
SHA1 hash:
e9dfeb9aa463cca85cc8d86356b85f5cf1c4f1cd
Link:
https://www.unpac.me/results/cdc91e07-0959-4942-b631-898ef6694eec/
SH256 hash:
057e12f6fd9dda68017f4cd2fa5d64213505b8a7592893cf64c298dd7b8dfad1
MD5 hash:
08f015f3368eb6b174ae76723731efc7
SHA1 hash:
c6ce6a7f2dd00ac05e8e9d45bbba65b7f9616559
Link:
https://www.unpac.me/results/cdc91e07-0959-4942-b631-898ef6694eec/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

a503f2270dfe99cb3292c708b609e19f

AgentTesla

Executable exe 3b02adbda158a35f586aa1f17780dc8d5cd0404c864a16b8c6b5a8f2b02363f9

(this sample)

  
Dropped by
MD5 a503f2270dfe99cb3292c708b609e19f
  
Delivery method
Distributed via e-mail attachment

Comments