MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4463f1c552020c3ec8e199d8369a96abe0729d055b487c2226938897629e5e80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4463f1c552020c3ec8e199d8369a96abe0729d055b487c2226938897629e5e80
SHA3-384 hash: 585cf96c1d37868ba534c94e85502319856473f3c1b9314d9a482ce386f0258ec070a62274afd7045c618551f0daa0be
SHA1 hash: 87a424f96bf0a92aa284c3dc0ad8898ba4972656
MD5 hash: 3e9bc2db09c263ed62e3952bf5be5476
humanhash: kilo-wolfram-five-mexico
File name:transferencia.PDF.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:505'344 bytes
First seen:2020-08-12 18:20:08 UTC
Last seen:2020-08-12 18:51:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'605 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:oj1XEIXSSiXp3ETVNVoUBoihGYe+j4VT:ojTUxETH6UNG
Threatray 10'774 similar samples on MalwareBazaar
TLSH 5EB4027153796B52CABD2BF88642104027F625A7F771E39C1C47B5E64A76F303A806B3
Reporter abuse_ch
Tags:AgentTesla bat


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.spiact.ro
Sending IP: 81.18.71.206
From: Lucian Grigore <lucian.grigore@rd-enginery.ro>
Subject: Registro de Cuenta Interbancaria en Dólares
Attachment: transferencia.img (contains "transferencia.PDF.bat")

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/44406/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.8373.431.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/423593
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Double Extension
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4463f1c552020c3ec8e199d8369a96abe0729d055b487c2226938897629e5e80/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:22:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irr7drksaigd5shbthmdnguwvpqhfhiflnehyirgsoejoyu6l2aa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1e1ab7c62b4c738adfd04a5b4c1b80f1ac02529f31f3de1a3755d4e10c317691
AgentTesla
2b240e538c485ce1cd60859798a4465b0b7d2986dac69021d7e68b5a28db4322
AgentTesla
43e79fcb9d7809f2dce99e5307cc05438b2926fce4aa24fefc8201adc694eed9
AgentTesla
558c8de9bd5bbcea6e779b8dd474f36cf57317b44aa744ac8562495cf321155b
AgentTesla
653f9230a0dfc61996a0213363c938cc629fe374f877febd3df485369d1f476a
AgentTesla
6939b1aa4bf9c37c9228fecf34688f9c1f9e137a47165ca2befdc04f20a298ef
AgentTesla
9c3a4bfb0cb3da7187e39fdc53a216066058b5607bd1f1857249f7908912b48c
AgentTesla
b9508603c41846350bb34a90903bb273c60932e6f9d941e3ffbd6dadc2879f09
AgentTesla
d0ca5d037015b6a8cc4fba70d698c781b9c0c445c408d4521e458d422a8e7e41
AgentTesla
e2cbded6f889f93a08c2889a5c93385b3b58a569169c17cf08fc667fa8869021
AgentTesla
+ 10'764 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200812-pzgylpn1aj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/4463f1c552020c3ec8e199d8369a96abe0729d055b487c2226938897629e5e80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 9c325ad8be21ef3854bfa6ad8973e2fb6a78483efdbdb6b5b73721792fe76c7b

AgentTesla

Executable exe 4463f1c552020c3ec8e199d8369a96abe0729d055b487c2226938897629e5e80

(this sample)

  
Dropped by
MD5 6ca4414f1fdfa27927daebaf4e6d4fe9
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 9c325ad8be21ef3854bfa6ad8973e2fb6a78483efdbdb6b5b73721792fe76c7b
Cape
Cape
https://www.capesandbox.com/analysis/44406/

Comments