MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce
SHA3-384 hash: 28b3b0079693cc36ff879b2bc453351336e9234ba77b0cad830fbdf2f1e376d2256520199c36eb6a066ff2885ac15348
SHA1 hash: 61bc2d6a979b86a75deec00c52b713d2bdda42a1
MD5 hash: 76ad1a07d31c0f8806669bfc1dd2e1cb
humanhash: india-network-florida-kentucky
File name:Document rfq Creep Valves & PSVs 20_058_AA_Data Sheets and Drawings_scanned from xerox device001.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:736'256 bytes
First seen:2020-10-16 13:50:17 UTC
Last seen:2020-10-16 15:15:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:5QUnvYLTFP0f2Czuvh4mtuB47cRIlMI4V7azlawxw4:5QnLRP0f2CzMWmo475CIzzlawxw4
Threatray 598 similar samples on MalwareBazaar
TLSH BFF4692422545BA1EC7FB3BB34ADD81057E6BC8F9731D60D7F943F8A3A63A804562706
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.atlasofset-tr.com
Sending IP: 188.225.18.183
From: Enquiry TMOGD Division <enquiry_procurement@target.ae>
Reply-To: mails@target.ae
Subject: RFQ - Creep Valves & PSVs - 20-058-AA
Attachment: Document rfq Creep Valves PSVs 20_058_AA_Data Sheets and Drawings_scanned from xerox device001.img (contains "Document rfq Creep Valves & PSVs 20_058_AA_Data Sheets and Drawings_scanned from xerox device001.exe")

AgentTesla SMTP exfil server:
smtp.goldsterm.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72074/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.424.1716.14058.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493748
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299340 Sample: Document rfq Creep Valves &... Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Multi AV Scanner detection for dropped file 2->37 39 13 other signatures 2->39 7 Document rfq Creep Valves & PSVs 20_058_AA_Data Sheets and Drawings_scanned from xerox device001.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\...\eyKdHlGvCFWVK.exe, PE32 7->19 dropped 21 C:\...\eyKdHlGvCFWVK.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\Temp\tmp4DE.tmp, XML 7->23 dropped 25 Document rfq Creep...x device001.exe.log, ASCII 7->25 dropped 41 Injects a PE file into a foreign processes 7->41 11 Document rfq Creep Valves & PSVs 20_058_AA_Data Sheets and Drawings_scanned from xerox device001.exe 6 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 smtp.goldsterm.com 11->27 29 us2.smtp.mailhostbox.com 208.91.199.224, 49746, 49747, 587 PUBLIC-DOMAIN-REGISTRYUS United States 11->29 31 192.168.2.1 unknown unknown 11->31 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->43 45 Tries to steal Mail credentials (via file access) 11->45 47 Tries to harvest and steal ftp login credentials 11->47 49 Tries to harvest and steal browser information (history, passwords, etc) 11->49 17 conhost.exe 15->17         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 01:47:45 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lq7d2onvva6civrjobfuicudcdwv7zwjto2vtihwtqfp3yapztha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
20fe1d90bb66801400e3f746afb2408c1f17a772282f82bf707376559395e9fa
AgentTesla
3ae83a13a6fe98f6d3b293d69aa7e58e4752e4b1353978e1a390314f725ea44e
AgentTesla
5967386e3a83cb9e0066223388892aade38751662b856048184c262239411aae
AgentTesla
69e28c099c18f7fd000440db3155e9818916f70535e10b392ae7c1fb54ba48be
AgentTesla
77e828d113038623ccfca7e111b60675fd36ea404545f8ce828d7f8505244f0d
AgentTesla
796283950089c8792456eb6b2f89a148de3def99691115ae7aadf8dc930d4d4a
AgentTesla
82b2605b25b8443229154cf16788525e9dab3bdeff6b305792a11c0d5cd8e99f
AgentTesla
abd47175466abe2058151e12919ca9501497dbb286909bf7896d20d59fe73ef6
AgentTesla
bbcaf0746383dc1928fe53805da2d9bb28123e7495d48759202a46217e6b456d
AgentTesla
d38a8652771ca87506e06b24d7b6b21fd051042714faa477c7d7189c9bd94633
AgentTesla
+ 588 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201016-zzdv8bl282/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce
MD5 hash:
76ad1a07d31c0f8806669bfc1dd2e1cb
SHA1 hash:
61bc2d6a979b86a75deec00c52b713d2bdda42a1
Link:
https://www.unpac.me/results/8ab15d77-1db0-4ebd-aa40-560ffe6e0e34/
SH256 hash:
0046f4cb65ec8f3aa21b74c055ce42430b39751575b33f16f636b53f7da64b91
MD5 hash:
cb4d25fe22dc96614d6023d63730d30d
SHA1 hash:
6913df69226a3d4caafa2ac213ca050928a6f520
Link:
https://www.unpac.me/results/8ab15d77-1db0-4ebd-aa40-560ffe6e0e34/
SH256 hash:
202a5490c45002eaba29b969888fdd470bdb8742a85e61d6d3e54efaeba6d91e
MD5 hash:
6a281fba6e97a0dc2c0b6f68dd5b3683
SHA1 hash:
70998ef776db3cb9dccc3270f8bf03764cb43bd8
Link:
https://www.unpac.me/results/8ab15d77-1db0-4ebd-aa40-560ffe6e0e34/
SH256 hash:
2711ae643ca8c46f26569bd7491ee4c7b1497ce23113f66096dec9a5655a21e6
MD5 hash:
33ae4e15cf59ae1a50afa529ea4fce6d
SHA1 hash:
c1de875c4072acfe43b21bf514c5b83fab89e8a8
Link:
https://www.unpac.me/results/8ab15d77-1db0-4ebd-aa40-560ffe6e0e34/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/8ab15d77-1db0-4ebd-aa40-560ffe6e0e34/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 90e50c561ca9796066b2481e60116b830338b29ed06fcc7937a5f3627b84ffda

AgentTesla

Executable exe 5c3e3d39b5a83c245629704b440a8310ed5fe6c99bb559a0f69c0afde00fccce

(this sample)

  
Dropped by
MD5 d8b5acaa59354d1d1de0e1fff6f04ac0
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 90e50c561ca9796066b2481e60116b830338b29ed06fcc7937a5f3627b84ffda
Cape
Cape
https://www.capesandbox.com/analysis/72074/

Comments