MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a37a38711e333170654b8a7f194d33b65a31f573a99db3ea52c3a14bd8a053c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a37a38711e333170654b8a7f194d33b65a31f573a99db3ea52c3a14bd8a053c
SHA3-384 hash: 865377f3846d490e99f4937c30a8a816f30db8e952447b1872d23c07a486b3067af183b20468705594141e5296695185
SHA1 hash: 1dce4cdc25ffcf15d0a1101bb46392b266431afa
MD5 hash: c3f3d70542abeccc1dc0f24142394003
humanhash: mobile-saturn-six-oven
File name:MV PAVINO.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'646 bytes
First seen:2020-05-01 14:31:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 6144:bPCganNhay4uabenG9Z5JojN7Xmzv1II2CE8sMYblQVM15Mtns0UDlBBG1qEHGEV:Jannay4uadZQmKiEuIm4WtxUBBBdw7
Threatray 6'174 similar samples on MalwareBazaar
TLSH CD942345E5A2C4FBE1AB02F10C7C1EB39AE49D5518F8990B0B747DAC793325A211F73A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.vacuumcleanerservicecentre.co.uk
Sending IP: 104.168.219.118
From: Vungtau Ocean Shipping Agency <mail@vacuumcleanerservicecentre.co.uk>
Subject: Re: REQUEST FOR QUOTATION// MV PAVINO TRADER
Attachment: MV PAVINO.IMG (contains "MV PAVINO.exe")

AgentTesla SMTP exfil server:
mail.kingstoncomplex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Waldek
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 14:44:00 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ji32hbyr4mzrobsuxct7dfgthns2gh2xhkm5wpvffq5bjpmkau6a._file
Verdict:
malicious
Label(s):
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
0f24e222f76b19a0f1995c70e3711ab2b1c7e3f41c5e915796e767fce361e2e3
AgentTesla
1553300557f17e7cb62c914616267bc733854b98a0edc5215d901cc4f8e4d0f0
AgentTesla
19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c
AgentTesla
484ff6267219f9eb4794c1f20aaa9562a459e0d1a787743592b1532eda3be541
AgentTesla
496b39b696da8c81b7f0d57b3b591a9c948bf88d8ba375618703edcb18f4c27d
AgentTesla
b9c037384eaa82706baf7c3cd5e1550fe9ad24083edeb00e55d9da8198ea6ee3
AgentTesla
c158b8ed8c9a0221bfeb3dea8d026d5bb9bade9ecfd19191ada59c51c8eb4089
AgentTesla
c94fe7b646b681ac85756b4ce7f85f4745a7b505f1a2215ba8b58375238bad10
AgentTesla
e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d
AgentTesla
f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557
AgentTesla
+ 6'164 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 8c2c2528720834089925f584d094a2b35e2450d0af9020aae081a46d4c84f4b0

AgentTesla

Executable exe 4a37a38711e333170654b8a7f194d33b65a31f573a99db3ea52c3a14bd8a053c

(this sample)

  
Dropped by
MD5 dea56a6ec733a66ef9a3d5d6994a1fbc
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 8c2c2528720834089925f584d094a2b35e2450d0af9020aae081a46d4c84f4b0

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::SetFileSecurityA
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExA
SHELL32.dll::SHFileOperationA
SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileExA
KERNEL32.dll::MoveFileA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments