MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c
SHA3-384 hash: 6af6f707c83f1ce6b3759431069666648e2adb8a7ae3659d7174c37f0a6ad1208e97353cc07d54e91b6b06c5d0c5e818
SHA1 hash: 6950c20de7241b7b16646c28ab94715f54bd4ffb
MD5 hash: c785c3142fbe0e47c18403e00a94af7a
humanhash: failed-artist-dakota-moon
File name:SOA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:904'192 bytes
First seen:2020-10-22 06:00:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:lsDGMuz5lJbD5pDwk7GpekWIRaC6uJ0raCbwc+Op09A1GKZHNYPzodldboC:yDRilVweIRazuqGC1JpcA1GUKzodj
Threatray 711 similar samples on MalwareBazaar
TLSH 5315D000B69DABB9CD6B56F6F11B845203F40E3A6950DE3209ED7FCA5760371A4ECE12
Reporter abuse_ch
Tags:AgentTesla exe geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: de05.enroot.cloud
Sending IP: 89.22.105.49
From: Mahesh Merugu <mahesh.merugu@epiroc.com>
Subject: RE: 대량 주문 SOA
Attachment: SOA.zip (contains "SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74420/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.16579.21817.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/506585
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 302462 Sample: SOA.exe Startdate: 22/10/2020 Architecture: WINDOWS Score: 88 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected AgentTesla 2->19 21 Yara detected AntiVM_3 2->21 23 3 other signatures 2->23 7 SOA.exe 3 2->7         started        process3 file4 15 C:\Users\user\AppData\Local\...\SOA.exe.log, ASCII 7->15 dropped 25 Writes to foreign memory regions 7->25 27 Allocates memory in foreign processes 7->27 29 Injects a PE file into a foreign processes 7->29 11 RegSvcs.exe 2 7->11         started        signatures5 process6 process7 13 dw20.exe 22 6 11->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 18:55:24 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=koemodxr3g74iffjfq5kj2ru3nuzf3tqlaj3lnfcwtbiwq24x5wa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2c4f7516214ad84b31d2468ff496720193ea743bdb260287e2ef9ec48014b493
AgentTesla
42f380a4730febf7e17ebd7e610ba0f727d6324f9c68317df70c0e0bbebd9290
AgentTesla
6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241
AgentTesla
6eced51e9e9f798e79627188c69026a06a576021d112c8b94ed517f2576b009f
AgentTesla
6f0c98efd3149c8527cf3f700d123da142275f32c166cf2ca2b186d1acc1286c
AgentTesla
7111d53f0aadacbcfcfcddd68810a4ee3042e5e532457186ee3fdc5618063d45
AgentTesla
8600c1896f8c6835a9a5c44631ac45b319c0cc9b2e0a50a72bb37436a84ea96a
AgentTesla
98f16bf7fd0d32ebf300230c3992712556f0bebc91678c4a6da74f7a900be68b
AgentTesla
bae353be3d64c66c76ca33280e436b02460497265e503b772db81c2e84971cba
AgentTesla
e69f4c47b18fd9ffa5a35b69cb0e7fd57967fa542334b6a48b449ae123030646
AgentTesla
+ 701 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201022-wzdndebn4e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
ServiceHost packer
Unpacked files
SH256 hash:
5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c
MD5 hash:
c785c3142fbe0e47c18403e00a94af7a
SHA1 hash:
6950c20de7241b7b16646c28ab94715f54bd4ffb
Link:
https://www.unpac.me/results/2789579b-f73d-488b-9942-971a17c4e058/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/2789579b-f73d-488b-9942-971a17c4e058/
SH256 hash:
a110aa720d1297ca0852983e83e0e4d087d450d069ce6f05050dd51330b65fca
MD5 hash:
3b5d76983deaf39577ce7545a6e2d2b0
SHA1 hash:
5ae176bb0d03c57a03db23857b3bd2689bc397b8
Link:
https://www.unpac.me/results/2789579b-f73d-488b-9942-971a17c4e058/
SH256 hash:
efcdfd794313a27ec6dfbe11a5366fa26333b9f0e3ed667416f8da981bee490f
MD5 hash:
bb6050fbe7cb2edf43bbc08635c74873
SHA1 hash:
b7ec8e511b0cdfdb1c4c0b9c3128ec5a826a6e61
Link:
https://www.unpac.me/results/2789579b-f73d-488b-9942-971a17c4e058/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e

AgentTesla

Executable exe 5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c

(this sample)

  
Dropped by
MD5 95ef3cde2f83a1e3d5e7c1b34ee98aa2
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 13b5e12ff1079a1ef0e2ea1978e04baf86473ad669d7d3145eb01fa1b6a6e75e
Cape
Cape
https://www.capesandbox.com/analysis/74420/

Comments