MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 415e3b94a339a45d036814c1bfbae3a24befccaf6bbba44a5265613f3aec3ef7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	415e3b94a339a45d036814c1bfbae3a24befccaf6bbba44a5265613f3aec3ef7
SHA3-384 hash:	b436f87afcad0bffa314085cc4857fb321ee80081545a9931454813a7657c8feddc1d05e0ffa211c5e901414420c833a
SHA1 hash:	8599d6d2c48067e3c29cd751dba94ed06313fd75
MD5 hash:	a0ce94d59dc8204e8cdbce7c4d635d32
humanhash:	stairway-wyoming-wolfram-lamp
File name:	New Order Inquiry.PDF.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	678'912 bytes
First seen:	2020-12-03 08:54:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:dCwIOQkVSTBzKLpq5ymZviBzXCBkfSdT7MvZgwu22qPVGNbTuMuKBD7hpvA:dDfkBzoA5ymYZx6VAmwuKST0sDd
Threatray	1'646 similar samples on MalwareBazaar
TLSH	6AE47D39AF581A3AF53AAB7CC5B02055A7FD6793B307C99D2CB201C90B639029ED153D
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

From: enquiry-rstc@cic.hk
Subject: New Order Inquiry( Former GE SEALANT CO.,LIMITED )
Attachment: New Order Inquiry.PDF.gz (contains "New Order Inquiry.PDF.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/106558/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.42726.23140.29567.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/554459

Signature

.NET source code contains very large strings

Found malware configuration

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Moves itself to temp directory

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/415e3b94a339a45d036814c1bfbae3a24befccaf6bbba44a5265613f3aec3ef7/

Threat name:

ByteCode-MSIL.Trojan.Woreflint

Status:

Malicious

First seen:

2020-12-03 08:55:08 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ifpdxffdhgsf2a3icta37oxdujf67tfpno52isssmvqt6oxmh33q._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

63301b24f3d0794ef1dfac023a0eb80f731e88f270f56060c82e6de18710fe28

AgentTesla

7d47aae61d6960e7900bb2102b481114a8d948f13cc404082f376786e88959ad

AgentTesla

80d2742ad2aa2b84c5c32278be4a819400da0135ce52389e6ad711539d6ab9d6

AgentTesla

8642bef0da90b39eff7e2f28570d28aa2a9aaabcd181c9f64bcfbdd331a606f1

AgentTesla

9814c6959d79cae63bbff31a0c677e4eefade63e272f68047a54e715ddb445a7

AgentTesla

a12f642139a7cfe0891e40b83400cae049a06c959f742700d47f096ccaa32736

AgentTesla

c4cfc6eb77f1095f81578053857d14d9597a3c13aa35654fc2742989862ce6e8

AgentTesla

ced74986e807f1b4dd969d4811e20b516b11b39d0d8681ebadf9123a6de30b7c

AgentTesla

f9e0e3eb49ce4d6156f30deddef92e6b750d24ccafff82afdbe842244894c156

AgentTesla

+ 1'636 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201203-z9cny9gxvj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

415e3b94a339a45d036814c1bfbae3a24befccaf6bbba44a5265613f3aec3ef7

MD5 hash:

a0ce94d59dc8204e8cdbce7c4d635d32

SHA1 hash:

8599d6d2c48067e3c29cd751dba94ed06313fd75

Link:

https://www.unpac.me/results/e8d3d43a-7c28-40e8-bf1b-76534d6f6cbc/

SH256 hash:

9584f6d01e6452371cc9b4828030a13045d99c243c497b63628828e66aabe26f

MD5 hash:

7476e403eef14ac403c63c7279831780

SHA1 hash:

8387f558e30dc115987ac2b5c174a41302471abf

Link:

https://www.unpac.me/results/e8d3d43a-7c28-40e8-bf1b-76534d6f6cbc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/415e3b94a339a45d036814c1bfbae3a24befccaf6bbba44a5265613f3aec3ef7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.