MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb
SHA3-384 hash: 2a787d28a7edad1ddbd01d3acf9c2698b84c5f0103f58c2b7fb968b7afd16f9b7c5ae73f27ed3808bd5e15ef30ccc419
SHA1 hash: 753ba70908f856e5abd5e121cbcce3c07fa82036
MD5 hash: b2b5c8cf21cecec0c130b331a5e5be70
humanhash: rugby-social-avocado-don
File name:Purchase Order
Download: download sample
Signature AgentTesla
Create hunting rule
File size:483'328 bytes
First seen:2020-06-29 09:04:48 UTC
Last seen:2020-06-29 09:52:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:saVjlo7i+mb4FH9xK76fH8vFzvm3erQfnSgxBbyDbbdnGMLEBvfm+pxtwGgwTmrQ:saRlo7hhK76fH2m3YQP/OD9GMLWv+w
Threatray 10'644 similar samples on MalwareBazaar
TLSH 76A4F12167DDA708E5AD0B7C5BA1620047B5A6237193F32D5BD8A1F91D333E18F12BA3
Reporter abuse_ch
Tags:AgentTesla Purchase Order


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.beeinspire.com
Sending IP: 115.124.125.172
From: Prakash International Pvt. Ltd. <raj@prakashchemicals.com>
Subject: Hello Sir/Madam
Attachment: Purchase Order.PDF.rar (contains "Purchase Order")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/16088/
Detection(s):
SecuriteInfo.com.Generic.mg.b2b5c8cf21cecec0.16195.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 09:06:07 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqh3bkjuh63uhksek7433q2yvklhq3fkksyvlf5lly7edftc6g5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
119d0e520473bf8e440f8d993206427b0379497442c37b4388419e19ae498056
AgentTesla
3b42a378cd7279c28767cf421cd3dec7562e5880bc42b3b9079303849e3e62c8
AgentTesla
5761ed082c15df8c9fb6fadcff317a227008848db681d92ae959fe481e05e212
AgentTesla
7013e2ac13e42bbee07bb06c5f9c2e4b625a6599a64bccf0e844ba2e995e0737
AgentTesla
75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a
AgentTesla
867979993b4e58bf11e73e11655e50ca97b55e91322e744b29241d3a47b7dcd2
AgentTesla
a5d81b3d4d0df91d286ae0f3db7d166ecd013e8c53d1677be5b149edb9d15d42
AgentTesla
a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949
AgentTesla
ccb65f79de018225e7ca824cc70f81726e771019e53785d7a2a3772548fcfa23
AgentTesla
e83b98a736b614af8adb721b387d5eda8d794c6fd58296a59a86c6faf9baf4ba
AgentTesla
+ 10'634 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200629-vdflglerr2/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Reads user/profile data of local email clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0902383f81df115f10470b60eb25b6d07593ba3756ef9de81340c2cd953e5635

AgentTesla

Executable exe 540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb

(this sample)

  
Dropped by
MD5 7d8d42212d880c49180059c7ab044856
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 0902383f81df115f10470b60eb25b6d07593ba3756ef9de81340c2cd953e5635
Cape
Cape
https://www.capesandbox.com/analysis/16088/

Comments