MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 594f5fb1a4eaeb649b2f293c5eab4da72d1b193e208e966f1351ef58be16f7ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 10

Intelligence 10 IOCs YARA 3 File information Comments

SHA256 hash:	594f5fb1a4eaeb649b2f293c5eab4da72d1b193e208e966f1351ef58be16f7ce
SHA3-384 hash:	69b405e1fd58698fd6b1aee1b4d2f82e422e0da30789fd6416c747cfce01cb0b5f6ae04942a0fd1090f799807fb1e398
SHA1 hash:	6b90b4bc6c840ffb28512618ab946b5c4a0c7d17
MD5 hash:	ceefdb1215a9e53ed5c84087d847c4a9
humanhash:	echo-sad-fish-indigo
File name:	order for Aug.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	665'088 bytes
First seen:	2020-08-04 07:49:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'642 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	6144:AHAgbCa8sGQTIMSJS+idbaLKqD8EJKx8yf7wML/DBI8j5:AHX8kTIha+F5O8krB
Threatray	10'634 similar samples on MalwareBazaar
TLSH	2FE42A297A43D406E93D0E3688A456D0B7B1B6463B11CB1F7ADA2B5C5E037CF3B0625E
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: host75.registrar-servers.com
Sending IP: 198.187.29.36
From: Caribo Outdoors <info@cariboooutdoor.xyz>
Reply-To: abcarlioffice@gmail.com
Subject: Caribor Orders for August
Attachment: order for Aug.img (contains "order for Aug.exe")

AgentTesla SMTP exfil server:
smtp.gmail.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/38329/

Detection(s):

Win.Malware.AgentTesla-7660762-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Using the Windows Management Instrumentation requests

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/408854

Signature

.NET source code contains very large array initializations

Contains functionality to register a low level keyboard hook

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/594f5fb1a4eaeb649b2f293c5eab4da72d1b193e208e966f1351ef58be16f7ce/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-08-04 07:51:05 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lfhv7mne5lvwjgzpfe6f5k2nu4wrwgj6echjm3ytkhxvrpqw67ha._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2d863af0251409bf029443b1981194470a72aafede60137d6c88d32773e39bc3

AgentTesla

57c1873ebd6818c6fb4425f51ca1a2450bf4da0dc4a3269e637dfe1ea13dc42a

AgentTesla

63e08221ae27afac73c31e6ac42c07501bbb6f0ddfbe571651a1c1045b270653

AgentTesla

69f1c868160889c695289bdbe169f29d34adae6785478f5954023464420324d2

AgentTesla

8a6e7f587f69fcb329022d9036a65c8515a2652f2457f29e4e26d00f81e08355

AgentTesla

9f80f311d2f6a2ccaa0d4aa42ce625b6317a1785a9bb52bde2fa68f68fc7f68f

AgentTesla

cf8fab966145ea0701db997fd11c2969c984d6793d668f84e113f358274150a6

AgentTesla

d50395ef9eff3dbaf836d41028e7231cecd43d80880592f2668e0be8cab5b06d

AgentTesla

dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f

AgentTesla

+ 10'624 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

keylogger stealer family:agenttesla

Link:

https://tria.ge/reports/200804-zee3w465rn/

Behaviour

AgentTesla Payload

Agenttesla family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/594f5fb1a4eaeb649b2f293c5eab4da72d1b193e208e966f1351ef58be16f7ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar