MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: 4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516
SHA3-384 hash: 857ab4bfc34b1dfaefcdef580302e51c66ff12cb0543c27cff1add45d2a987991b353152437e9fef133a2b8ce895014a
SHA1 hash: 289c5aaa099d079e9c72e70ebf0ea5221f1bada5
MD5 hash: 5cabd28bcebd7545965402844c927d29
humanhash: march-cold-artist-asparagus
File name:PO#_30-06-2020_1051_0001.bat
Download: download sample
Signature AgentTesla
File size:445'440 bytes
First seen:2020-06-30 12:02:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:IqztspAdB24I9bk9P4iACBzSeW4q5F0Z2Q19XOQWo0b6m2:IqZspAXtI9wXv85IjJKbG
TLSH 3F9412B9237A4B29C6BED7B8616064200FB6F5273421D32E2F55A1CE4A77B109770F27
Reporter @abuse_ch
Tags:AgentTesla bat


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: www1.webmail.pair.com
Sending IP: 209.68.6.94
From: Alshima Aluminium <request@webmail.editage.com>
Subject: Request For Quotations - Scan_30-06-2020_1051_0001
Attachment: Scan_30-06-2020_1051_0001.rar (contains "PO#_30-06-2020_1051_0001.bat")

AgentTesla SMTP exfil server:
mail.gimpex-imerys.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 27
Origin country US US
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17095/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 12:04:07 UTC
AV detection:20 of 31 (64.52%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-rdjp71lqye/
Tags:spyware keylogger trojan stealer family:agenttesla persistence
VirusTotal:Virustotal results 17.81%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

fff669d42513b82de89b145afdb15e22

AgentTesla

Executable exe 4a0345609160627cbdc8b4ea076b1b755d9817e89f95d6ec8f6d51554c62d516

(this sample)

  
Dropped by
MD5 fff669d42513b82de89b145afdb15e22
  
Delivery method
Distributed via e-mail attachment

Comments