MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74
SHA3-384 hash: 11f623b1d856db6bbf8ee12a3a5492562b06a73e18a30469256c8ce27c891b6f271618347ef124bce2db8ee65ace1803
SHA1 hash: e0f0254cb455e9bd746b5afc38caf955062620e9
MD5 hash: 2b19a6000e30f00917aa9a287e57dead
humanhash: maryland-zebra-shade-cola
File name:2097508E2-2-1C358609BA01.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'296 bytes
First seen:2020-10-16 12:56:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd0ccfffe29beda9bfd332e673d3d4c7 (3 x AgentTesla, 2 x Matiex, 1 x Formbook)
ssdeep 12288:U7Ly6mTO+low6rIQl899BZo3cloeNZQDeJJgYVg:Uvy6mjCg+1eHQDkyY+
Threatray 22 similar samples on MalwareBazaar
TLSH 87B4AF22B3449CF5E423223984B4EC2409BBFD366A2F484E77553B6D8A763911176F8F
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.209
From: emendez@farwestcorrosion.com
Subject: PURCHASE ORDER ( INVOICE) URGENT!!!
Attachment: 2097508E2-2-1C358609BA01.zip (contains "2097508E2-2-1C358609BA01.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72025/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a window
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/493599
Signature
Machine Learning detection for sample
Maps a DLL or memory area into another process
Writes to foreign memory regions
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299250 Sample: 2097508E2-2-1C358609BA01.exe Startdate: 16/10/2020 Architecture: WINDOWS Score: 60 16 Yara detected AgentTesla 2->16 18 Machine Learning detection for sample 2->18 7 2097508E2-2-1C358609BA01.exe 1 2->7         started        process3 signatures4 20 Writes to foreign memory regions 7->20 22 Maps a DLL or memory area into another process 7->22 10 MSBuild.exe 2 7->10         started        12 conhost.exe 7->12         started        process5 process6 14 dw20.exe 22 6 10->14         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 12:58:14 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3s3v4nu3ambtbbpu4kfupwei3mvn7w3v6y2hu3no772a3n7zn2a._file
Verdict:
suspicious
Similar samples:
039b571653cbd974ebb9e8c37c048d0f9c4e5302db86a7400ed7a81708cb6c8c
AgentTesla
16fda49dd0a5b3c520619c1f5e88723cd2fe0c92b9cc2946416b2e29a1ccdfff
AgentTesla
3153b96e0d31eb2901117a088ffcdbe7e88ba65660171b0f0d43295ea21a27b0
AgentTesla
47602d03fd9625c7212ea4b5dbb919f587f4e5d5c3eedf58304bf5a851beac9a
AgentTesla
4a40496f800e2a11c1e2a12176d062b59fe536f18fb236f98e66231448aaa2e8
AgentTesla
a132044c5acdf6901718ff3e7b6cee80b0d976f32d8876b2352b08d316feacf7
AgentTesla
a4d0e327754a32781d1c9a2ab27f879e9f0cc0b7c5712fa67dfa4b0f9cf54492
AgentTesla
b69c69f5c302e64f4a4a27abd968404d6226d8b04724abe8121f4627e2a755f2
AgentTesla
d57b7809ae71b779b00aa2e7e3b55c3ff6c210453e19a872489e330285031ed3
AgentTesla
ec7484496f3a8f5ba5228b50c008988f85d871c5ff18f1e61b8da5cfb7d09b90
AgentTesla
+ 12 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201016-cehp2qplsn/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
ServiceHost packer
Unpacked files
SH256 hash:
46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74
MD5 hash:
2b19a6000e30f00917aa9a287e57dead
SHA1 hash:
e0f0254cb455e9bd746b5afc38caf955062620e9
Link:
https://www.unpac.me/results/6c1f5719-dd5e-47eb-b998-0d8cbf7cfa9b/
SH256 hash:
f749a55c4e3e2a0efd49860029f552da211b3cd73416ea9f1fd6552923407392
MD5 hash:
bc43ba38cdfcd834c78817e97fe06ec8
SHA1 hash:
f46f4685d3f772f039bf51db7114dc889c5161e2
Link:
https://www.unpac.me/results/6c1f5719-dd5e-47eb-b998-0d8cbf7cfa9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f1b8048cba6cdfe9cc5258148c37718e8f2e3925e0d780190eef0764d7e00800

AgentTesla

Executable exe 46e5baf1b4d81819842fa7145a3ec446d956fedbafb1a3d36d77ffa06dbfcb74

(this sample)

  
Dropped by
MD5 55e411722fdbf50235bf8605e3298258
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72025/
  
Dropped by
SHA256 f1b8048cba6cdfe9cc5258148c37718e8f2e3925e0d780190eef0764d7e00800

Comments