MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26
SHA3-384 hash: e9daaff32d750abaca70815514a43122d42f96a43c4a538d20b8c933cdda0b178d8838b376c978f5f2f04c08b9d6c541
SHA1 hash: fe54ac1c78776c893375a05ef460b34de79960fc
MD5 hash: 16fd4105195254fc7bf21fbe542428e6
humanhash: west-king-juliet-moon
File name:5-11-20_AB SEB bankas_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:817'152 bytes
First seen:2020-11-05 15:42:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:h5vrHlgIXNKqtJMGB7H/krHpjXd86rzn8qu3NXgjJDOEjA1t+UDn8JgSJlXWThZZ:HvrHCojJMGB7HZ0xi/82tZk0aiz
Threatray 981 similar samples on MalwareBazaar
TLSH 3D05BECD725471EFC827D472CAA82D74AA60B8BA831F5203942765EEDE5D887CF144F2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
mail.ingeniumhea.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83318/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 10:26:39 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkpb74ahevglo64qkrpwdxmouahn3q33baevavr3sxi37ptqxmta._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0233c43ce1cf759e1d8c8d343b03bfbad84652b12fe32b0e54b7fc7c08bdcc88
AgentTesla
32a780401adf987b558a2c7c4d1c9786360adb0a463d576ee01c1c71bc5fe9af
AgentTesla
3a5b1c9c7e10e40551f26dafe302f056f86ce6c6c138a96b0b79389a095b7fca
AgentTesla
3b730885744ae75260212b43010cbd9578df34c88450745169a56a99d2476ffa
AgentTesla
91816d916870f6e48ed8937694ab3108bfd6b57b1aef7a69dff474db7602e274
AgentTesla
98b586cd2517a8296335f30e0e363ab72b047d10e50cec33f41ed93b6b492ca6
AgentTesla
a26ca2bb8700a20c2f001d5def45dfa3c04357c84d39b3b64812d29e42e9c31d
AgentTesla
aa5d58519adc258a32494cee3551c16684a3d247c03ca114338756172fda96cb
AgentTesla
aefa2f5a8448c792183fedf9d025becfb782102b749c0fe3be273975f2dc3b61
AgentTesla
c64b982e4d39e00892526dfe075b7a35448b5d07e7dae1ec2df65dbce854773c
AgentTesla
+ 971 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201105-7ca21a4cja/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
0b8e4c7b781e6d68c0f52ff23383b0d85d149f5d12ed493ef42f9cf42bfce6bc
MD5 hash:
af7f528164cd10f9c001e4a42a8af485
SHA1 hash:
a807528e6f3380e72a4bac0859d7fca7977b8319
Link:
https://www.unpac.me/results/7b0f038c-c99e-401f-bffd-6836548c9019/
SH256 hash:
f7dd8518d23f7e46374c46e9bf9c493ec15c1baddc6a6849420472db3c34b9db
MD5 hash:
c2fe530cbdc884128823adfaa1c66c2e
SHA1 hash:
b0a8f85c7ebc0e783439d9f4cd387e2d3994e63a
Link:
https://www.unpac.me/results/7b0f038c-c99e-401f-bffd-6836548c9019/
SH256 hash:
a16bfc048d241b4b82e51b793518615e9c3a20e2e828d7fdc067ca0d6342d999
MD5 hash:
9264b9201726e78ad73f55940743c393
SHA1 hash:
bdeca9c82215014b9fdf95f66a1bd5d3a464ff0a
Link:
https://www.unpac.me/results/7b0f038c-c99e-401f-bffd-6836548c9019/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/7b0f038c-c99e-401f-bffd-6836548c9019/
SH256 hash:
5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26
MD5 hash:
16fd4105195254fc7bf21fbe542428e6
SHA1 hash:
fe54ac1c78776c893375a05ef460b34de79960fc
Link:
https://www.unpac.me/results/7b0f038c-c99e-401f-bffd-6836548c9019/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 5a9e1ff007254cb77b90545f61dd8ea00eddc37b080950563b95d1bfbe70bb26

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/83318/

Comments