MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803
SHA3-384 hash:	e9ad894f3ebb667c0c426fe826b47b7d7f9602d6e3f95f2a43660dd1bc5ae976d5032a2979c82cdd4d1dcc9075191936
SHA1 hash:	5aa787661f7cc4ba4cfcae4f835313ad46c4c0f8
MD5 hash:	219cef9161906de506e56e03ad365bd0
humanhash:	thirteen-jig-bakerloo-romeo
File name:	Kosser Order.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	663'552 bytes
First seen:	2020-08-31 10:28:40 UTC
Last seen:	2020-08-31 12:17:36 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a5b3a1e09e383877ce51c417b22d34c3 (4 x AgentTesla)
ssdeep	12288:YMdBkg/MHjPKL8/JoTrKIwRgxvEgMeHuCkUIJHhrzCRWJ2qx1:YM8AMmLo4rK/CvAeHmRJtb1
Threatray	9'814 similar samples on MalwareBazaar
TLSH	FBE423E2E003C4B1D59890302B56D8F2420FB89A1E7EB22BDC4DE95F64F53DB82D5A5D
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: ew0.704.maxzizo.ml
Sending IP: 167.71.206.34
From: KOSSER JSC <office@koser.com>
Subject: New Koser Order #2020240
Attachment: Kosser Order.r00 (contains "Kosser Order.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/53393/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Sending a UDP request

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/455230

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803/

Threat name:

Win32.Trojan.Smartassembly

Status:

Malicious

First seen:

2020-08-31 03:14:04 UTC

AV detection:

35 of 48 (72.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kzwmjheism5zzpawjpych5sy6y6fx35wkeghydumfm2v6xzvdabq._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

07b327461738337cd0b7f35dd60115e784b779194a014e2125eb5a3d2ad0451c

AgentTesla

48a05e42214277f9a4fe66017f03cce54570e22aab74cc8aa7e0a66ec4d3d4d3

AgentTesla

65bdf218a95af52100c20e6f146a7acf16aa0ed0a34ddc7f4a68c66554b648da

AgentTesla

869e8a26e04953a411e7454c800e022bbbb3825320ab6e3935213357789f0844

AgentTesla

a5602ba2bfa6fcd7b914266f63da512b1c212c75406731aaefa9fcbcd785a57d

AgentTesla

a84cf81fa2d7790ea8f5d59354fa47d2067a12c89c2d975ee2f3b9547765be1e

AgentTesla

d2bb06dc3882c72e26ed7598fee37d128955c229246225ed393d90bd2a4eb1dd

AgentTesla

d6ade904fb2225703807124276b3c9f8eeeb737d7f44aacc82eb63eee77cfa5d

AgentTesla

e94bd11a30ff7323b957c97d0f9825b925044f9743bf9bcf692966d045a56aa1

AgentTesla

+ 9'804 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

upx

Link:

https://tria.ge/reports/200831-25jvhpbc32/

Behaviour

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Tinba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/