MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f
SHA3-384 hash: 7755bf4bd107200554f3106ae8eefc5649ebd6f221e74b022923741ebd94226980083418895b30790a8d9325ca15cd06
SHA1 hash: cc5ecbb2a09a9f782d5b3c7c2939445f96fc141d
MD5 hash: 5097e69e8e70fc4b01ab4ea003ee47b4
humanhash: kentucky-sweet-foxtrot-louisiana
File name:Información bancaria de HSBC 4500521952.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:836'608 bytes
First seen:2020-08-13 06:31:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0aa3dcbdd0727cba5785897870b1d0ce (14 x AgentTesla, 6 x Loki, 3 x Formbook)
ssdeep 12288:FkTCaGA3RukdYUSTkq31mZqB5ke5C5y3ptXOaKCTnh0K5apkcAGM6D:c0CEU+DTk0lp52KukchfD
Threatray 10'883 similar samples on MalwareBazaar
TLSH 61057C62FED1083ED0F7153D5F7B5EF49C29BDD21A24585A2AE8484F7E3824C382919E
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: berriospr.com
Sending IP: 185.222.58.102
From: Alexander Rivera (Isabela) <alexander.rivera@berriospr.com>
Subject: Re: Información bancaria de HSBC
Attachment: Informacin bancaria de HSBC 4500521952.gz (contains "Información bancaria de HSBC 4500521952.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44861/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/425188
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Drops VBS files to the startup folder
Found malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Drops script at startup location
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 265149 Sample: Informaci#U00c3#U00b3n banc... Startdate: 14/08/2020 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Detected unpacking (changes PE section rights) 2->38 40 Detected unpacking (creates a PE file in dynamic memory) 2->40 42 7 other signatures 2->42 7 wscript.exe 1 2->7         started        9 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 2->9         started        process3 signatures4 12 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 7->12         started        52 Writes to foreign memory regions 9->52 54 Allocates memory in foreign processes 9->54 56 Maps a DLL or memory area into another process 9->56 58 Queues an APC in another process (thread injection) 9->58 15 notepad.exe 1 9->15         started        17 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 4 9->17         started        19 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 9->19         started        process5 signatures6 60 Writes to foreign memory regions 12->60 62 Allocates memory in foreign processes 12->62 64 Maps a DLL or memory area into another process 12->64 21 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 4 12->21         started        25 notepad.exe 1 12->25         started        28 Informaci#U00c3#U00b3n bancaria de HSBC 4500521952.exe 12->28         started        66 Drops VBS files to the startup folder 15->66 68 Delayed program exit found 15->68 process7 dnsIp8 32 smtp.yandex.ru 77.88.21.158, 49747, 587 YANDEXRU Russian Federation 21->32 34 smtp.yandex.com 21->34 44 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 21->44 46 Tries to steal Mail credentials (via file access) 21->46 48 Tries to harvest and steal ftp login credentials 21->48 50 Tries to harvest and steal browser information (history, passwords, etc) 21->50 30 C:\Users\user\AppData\Roaming\...\AppData.vbs, ASCII 25->30 dropped file9 signatures10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 01:49:12 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ijoqw2c2p64za6gdyp4bskoau6uig3fq7ea5jfik7suouhgjqopq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829
AgentTesla
27f576bd27f707cd9c62164def16b57878fd6d1d1ae6bbf1f905d4668c298517
AgentTesla
2f048ca43dccc9a40348e7be9ba59e487a683115b6d32c346dbbca531b597c82
AgentTesla
4b2ea6a05f162abced933abc57f1b74e9167bb070bd10a56a73745d908a6c57c
AgentTesla
82b29aea19d46b3da79de8efa015b73dd3589353e16b73579820ab8a1a0ec077
AgentTesla
aaefa26175b22b29d742082a016606aaf045c3c587f12ce4e975fed56abfada2
AgentTesla
b4b4e82b4584a55722d213ea607a3b1131caaa039589a27e12ba4feeeaee7fb5
AgentTesla
b4ebfd103993464897b2a45938edb01fec2e897cf8c46500b0b6264a57928f9c
AgentTesla
bcad6695db67460542b34b3cc87dfe3655175843828314d5c0a331a9d8b76f26
AgentTesla
e7cd9d6b370e89f736e5819565f9fabc8cddad256514e75672274ae11609dcb5
AgentTesla
+ 10'873 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200813-k41ag3mlse/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 88cb992765ba7d43807361a1ca76b6d33e03584dffaea2908b962f9cfae33328

AgentTesla

Executable exe 425d0b685a7fb99078c3c3f81929c0a7a8836cb0f901d4950afca8ea1cc9839f

(this sample)

  
Dropped by
MD5 176689d2f2e22f97389e8e66ac395fe9
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/44861/
  
Dropped by
SHA256 88cb992765ba7d43807361a1ca76b6d33e03584dffaea2908b962f9cfae33328

Comments