MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56fed2fa0de0cadceed9d9cbe72af5b30f979ae3617e7042b6a42895dc559a22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56fed2fa0de0cadceed9d9cbe72af5b30f979ae3617e7042b6a42895dc559a22
SHA3-384 hash: adfd6fff75180fbb232831683d9386de8085326de51fba762a7cbc543dfe5925ed68c5b6a303b2330b19755c9fe0f4ce
SHA1 hash: a421cc10ee2d877628b5819b3fab44912f3c2d88
MD5 hash: 62aa97cd148a8690bd6b29f5afa525b5
humanhash: lithium-pennsylvania-social-north
File name:9616 Advanced Order for P-Weekly 25-2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:692'736 bytes
First seen:2020-06-05 10:26:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a0f2ef0c3f2e6d478baacafaefbb4c2b (6 x AgentTesla, 5 x Loki, 2 x HawkEye)
ssdeep 12288:Cu3EjrY6vfxKKlxl+amOCaOGJxB7g466vWVjPzUC/ObZupoyWI:50jUEfx3+D8l6yWj/KyofI
Threatray 11'888 similar samples on MalwareBazaar
TLSH CDE4AF22E5A0543FC133167D5D0F5F7BA82AFA51395825466BE7DCF8AE392C1382B183
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.meshcreation.com
Sending IP: 167.86.98.99
From: Victoria Espino <smtpf0x-hzenr@hnmetals.in>
Subject: Advanced Order for P-Weekly 25/2020
Attachment: 9616 Advanced Order for P-Weekly 25-2020.gz (contains "9616 Advanced Order for P-Weekly 25-2020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 00:05:54 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k37nf6qn4dfnz3wz3hf6okxvwmhzpgxdmf7haqvwuqujlxcvtira._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
3360d30cdf77fbf02614fef65be6cef733382bfb1e1a04e7a63d9a787fe9134c
AgentTesla
429cba445e3970b4730fe186da96afff8106dfed7e3a70d45db5b3364fdadaa2
AgentTesla
6c23d5aac98c05cf9faca072f1875f7fcde253a4a782dda7d897681bda6f92d9
AgentTesla
832adc5d5e3bf4715638300095b94591756cc073be24309fd25aab8cca1c2972
AgentTesla
9026d8e80e90cca993c9c0a5978d2fc1eb92727127593d677441cf0909271e10
AgentTesla
919fa71c76a20b6a4dfa82c710ad189bfc1570725520fd430ed4cbe1410082b5
AgentTesla
a32c890b528201772e1214ada37cf8eb9b00ac778773b52b48d92607911d2433
AgentTesla
b44ef73bf2306886ca92291cbbdc5b0d07d6878f9a1b3c84ce476ca69cc4532e
AgentTesla
bb94a881c3aa20c54450ee7d907eae152aa667a7a3280f7b00b44051d92322f5
AgentTesla
e583af99eacb5d6801001cc6c8b052e3267cda7111832ffded94fa68ebe2d9e6
AgentTesla
+ 11'878 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-pbj1kftr32/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 12fc8c97e2e4a37b4ba355c3d74e295cf345b3ba779f494fa617bed048a4d4c9

AgentTesla

Executable exe 56fed2fa0de0cadceed9d9cbe72af5b30f979ae3617e7042b6a42895dc559a22

(this sample)

  
Dropped by
MD5 11cd1c05f90102f3bda79ed059a43cae
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 12fc8c97e2e4a37b4ba355c3d74e295cf345b3ba779f494fa617bed048a4d4c9

Comments