MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d27b24408ccaed59ba5977e7e7309fc42fc9964bc4e3d4cd3ac363f1b539454. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	4d27b24408ccaed59ba5977e7e7309fc42fc9964bc4e3d4cd3ac363f1b539454
SHA3-384 hash:	eac109458374157d3dfac22e14f4bde921e9bd7e4a14a4e77918117124594be355971976160d0faacdf3612ea0e02653
SHA1 hash:	14aca1fb1f94cfec8df13feeb799a76eb3d79442
MD5 hash:	c7595cbdc96706af2cc18a2d6a6da473
humanhash:	cat-dakota-saturn-zebra
File name:	SWIFT Invoice.P.D.F.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'106'432 bytes
First seen:	2020-08-31 05:38:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	73ae1eef07955a270fc7a7f873444c85 (16 x AgentTesla, 8 x MassLogger, 5 x Loki)
ssdeep	12288:9R/MXPsQjiTiCAeeJpWkjumgIvSQCutDEVFbtir4247AQrns/WSFxG3zNlmUmHHU:fQvrCXEucruic247nrns/PxGDaUMHU
Threatray	10'493 similar samples on MalwareBazaar
TLSH	99359E62F2924433D5732A389D5B57B49C3ABE006D2878467BF9DD8C4F3978138392A7
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: ew0.ckcmeinron.gq
Sending IP: 139.59.89.144
From: "August Payment SWIFT " <pratimeshshetty@rust>
Subject: August Payment SWIFT.
Attachment: SWIFT Invoice.P.D.F.cab (contains "SWIFT Invoice.P.D.F.exe")

AgentTesla SMTP exfil server:
smtp.zuarakltd.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/53233/

Detection(s):

PUA.Win.Adware.Webalta-6854075-0

PUA.Win.Adware.Webalta-6862190-0

PUA.Win.Adware.Webalta-6879873-0

SecuriteInfo.com.Trojan.DownLoader34.29944.17906.10656.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending a UDP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/454821

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4d27b24408ccaed59ba5977e7e7309fc42fc9964bc4e3d4cd3ac363f1b539454/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-31 00:03:20 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jut3eraizsxnlg5fs57h44yj7rbpzglexrhd2tgtvq3d6g2tsrka._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

1289f5513a82e5b27515b92da2d935b22e2f839456a5bd595f245f22ad755c5d

AgentTesla

611656c80c7c9b32e24f770d70ba8488cd2b4079b35f7308fd4261d06480ec3f

AgentTesla

757f7141daf24169ff3694cdf0247b7ce0b71c66a970837a71149a69b5b6d371

AgentTesla

8a1c7d516ce87b96194a19289d40a13f1cde869e3cfa844c3ec5a0b3a8899d38

AgentTesla

99fa917c6f97756ac7ced3ca06142728178550f72be70326ab30420fd4e9797e

AgentTesla

a56ac149d3383c72f8c59076bace31e4c80c1d88a0c7a8e00cfccfadc1c1ea60

AgentTesla

ad660d774f78137622d038976557c8782211dbfd39d2ff9a7a4bcc9279ba0f41

AgentTesla

f484f2e953d9571e035e86dd89c82755ce0684fddd30b3d41bac21ac65f0cff4

AgentTesla

f973277a035ffef0b6da3768b836cb041895b7db7d9af0e89dbd2af3a55b3dfe

AgentTesla

+ 10'483 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

upx keylogger stealer spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200831-j3my16l2e6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Tinba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4d27b24408ccaed59ba5977e7e7309fc42fc9964bc4e3d4cd3ac363f1b539454

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar