MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb
SHA3-384 hash: fd57e684e5ad6f1ccef6dbe005413d5d53bdd26b6ea116d2ab7fe76a0586b017b28c7c33a9fdad3d9eed5e35c0a52a9c
SHA1 hash: d19325180a6001d365dacb65df91649ae6f08439
MD5 hash: 73a729f9dfc1fbeb4a22a9f1c97efd41
humanhash: dakota-ohio-nebraska-nuts
File name:CreditAdvice_0240.bat
Download: download sample
Signature AgentTesla
Create hunting rule
File size:622'080 bytes
First seen:2020-12-10 11:12:06 UTC
Last seen:2020-12-10 12:32:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:lB/b61M5Da5A5rvUukivmnc7509ePsE2KbMWBAmpEwNL7bcm0HVVWFmURJrvBrUm:loq5b5zUuJmnc74ayKI4AmpEwf0I
Threatray 1'786 similar samples on MalwareBazaar
TLSH 2BD47CDC765076DFC967C872DA982C64EA6074BB430BD203A05325EDAA0DA9BDF141F3
Reporter abuse_ch
Tags:AgentTesla bat


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server71.tr4.dhs.com.tr
Sending IP: 139.28.4.71
From: CBD-e-RemmitanceAdvice@cbd.ae <besler@beslerun.com>
Subject: Delivery Notification
Attachment: CreditAdvice_0240.7z (contains "CreditAdvice_0240.bat")

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107638/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.24565.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 10:40:13 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=klkriy4zem4vza4nn5ucys7aftr3u77tyxpgcobe4uooakakotfq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08f9ff6bbe01d3fab54974c872fbdf2f8fa1fd1f32649c776f0626030169272c
AgentTesla
320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e
AgentTesla
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
AgentTesla
67377c6c2259974077c2b7476f77823862ed6d5c6ce95c579e101b3d0a81b71e
AgentTesla
6f175e5ca3aed259ec1288d9dbd2510bff46dd383f95c07d9495570699934445
AgentTesla
9c7002e97c59c4c190abb09e373a5f1010b4790dbcb714e792538e73820d5609
AgentTesla
acef7155f56a1434770c602a92ebf4945474ad85e9382df19ff5d3ffee461423
AgentTesla
b64834eeb000aadaea8048153c40436a4aa12e1ed93b506e5fb7146465b4943c
AgentTesla
ecf592d2aed1d17b4c75e72a40edeb9b4396c8c9181cee7519ebe63bb7391870
AgentTesla
fb1c77156c32d3643f2b21550110a48c3bbf869d2f0aa099b7400646e1fcaeb5
AgentTesla
+ 1'776 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201210-z17edqzha6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
c88a66cbf00b12c88e2b970b8bc220e970e8465e56098ced24e97d42be901b94
MD5 hash:
a60401dc02ff4f3250a749965097e13f
SHA1 hash:
3f22d28fd765f831084cb972a8bd071e421c26a1
Link:
https://www.unpac.me/results/a7c6aab2-3547-446c-a896-41f2e8b7ddf0/
SH256 hash:
ebdbdb7961668b3dccb621cb66471f7496283d563565cef2e9a7602d7cce0028
MD5 hash:
240a42fe14ad329161632de4adb204f6
SHA1 hash:
69756521887b3900ff59df760cfd5294886b2618
Link:
https://www.unpac.me/results/a7c6aab2-3547-446c-a896-41f2e8b7ddf0/
SH256 hash:
52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb
MD5 hash:
73a729f9dfc1fbeb4a22a9f1c97efd41
SHA1 hash:
d19325180a6001d365dacb65df91649ae6f08439
Link:
https://www.unpac.me/results/a7c6aab2-3547-446c-a896-41f2e8b7ddf0/
SH256 hash:
3135b45005be6b9cc03b96245f91b955b42399a9e76878dae2c2933c41ebf8fb
MD5 hash:
2999ba483361ef74462f80a8702f2301
SHA1 hash:
d98f3287a312c5b1aee1ffdba4c8fe380d983380
Link:
https://www.unpac.me/results/a7c6aab2-3547-446c-a896-41f2e8b7ddf0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 14f19746c6660c46e975cd25c1bd53588b827e6979bcca8cfdd25a07c5cc1632

AgentTesla

Executable exe 52d514639923395c838d6f682c4be02ce3ba7ff3c5de613824e51ce0280a74cb

(this sample)

  
Dropped by
MD5 cdad7955ecfa40adb4b0224cf8d3be52
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 14f19746c6660c46e975cd25c1bd53588b827e6979bcca8cfdd25a07c5cc1632
Cape
Cape
https://www.capesandbox.com/analysis/107638/

Comments