MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50164e4a88c5cef2e1adf6967dcc0098f654cfb74258871c3645a12e6160c55a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50164e4a88c5cef2e1adf6967dcc0098f654cfb74258871c3645a12e6160c55a
SHA3-384 hash: 400d07e97a67e6986ee853add2ebc3899871c8e40b7a8cdc40a2756a68a0ad133f1ca8a8737d672b5e55bc91d411b22d
SHA1 hash: 8f18a0c749b19d55189ec1d0d724bc95f01be8c3
MD5 hash: 6ea42813a2825060e6f6b6328ecb9d27
humanhash: diet-angel-hawaii-illinois
File name:PO. Request for quotation.xls
Download: download sample
Signature AgentTesla
Create hunting rule
File size:212'992 bytes
First seen:2020-07-28 13:56:28 UTC
Last seen:2020-07-28 15:02:27 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:wk3hOdsylKlgryzc4bNhZF+E+W2knXLzdmz89X6xi0yPrwTqMXoPLvNNZHZ5pNcz:TLzUz82yUTXXoPLvNXPpNre
TLSH C824F1B7F3D17856DE5A033884A60BC5E62EFC656FA3814BE216F34E6B749C08A07543
Reporter abuse_ch
Tags:AgentTesla COVID-19 HostGator xls


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway32.websitewelcome.com
Sending IP: 192.185.145.122
From: Glaiza V. Convento <dc.fg106@htco-qatar.com>
Subject: New Inquiry for Covid-19 project/PO-Urgent Request For Quotation
Attachment: PO. Request for quotation.xls

AgentTesla payload URL:
https://a.uguu.se/vaqwvo.jpg

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.Macro.Generic.e.b5b459b.31232.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a file in the Windows subdirectories
Creating a file
Running batch commands
Launching a process
Sending a TCP request to an infection source by exploiting the app vulnerability
Creating a process from a recently created file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/400480
Signature
Creates HTML files with .exe extension (expired dropper behavior)
Document contains an embedded VBA with functions possibly related to ADO stream file operations
Document contains an embedded VBA with functions possibly related to HTTP operations
Document exploit detected (creates forbidden files)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50164e4a88c5cef2e1adf6967dcc0098f654cfb74258871c3645a12e6160c55a/
Threat name:
Script-Macro.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 13:58:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kale4suiyxhpfynn62lh3taatd3fjt5xijmiohbwiwqs4ylayvna._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro
Link:
https://tria.ge/reports/200728-hhcas3ns4n/
Behaviour
Suspicious Office macro
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/50164e4a88c5cef2e1adf6967dcc0098f654cfb74258871c3645a12e6160c55a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xls 50164e4a88c5cef2e1adf6967dcc0098f654cfb74258871c3645a12e6160c55a

(this sample)

AgentTesla

Executable exe 72d61ba8aa584dac7ed458f0ec2d41b31b9413fbec60f19377fd2873ee859b4f

  
URLhaus
https://urlhaus.abuse.ch/url/420684/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72d61ba8aa584dac7ed458f0ec2d41b31b9413fbec60f19377fd2873ee859b4f
  
Dropping
MD5 bdca322d0cfa3a8b85d4b1a4eca3675c

Comments