MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd
SHA3-384 hash: 4de747beee12114c9effc87336947d77d6634e4cbebebf3ab1c454c01c8cb194cd00a00436f8ee7ae66a05f7d2cba144
SHA1 hash: e9e3f6bc7ea2acca794563165f8a7e9dcc17c885
MD5 hash: 9f494167636f0baae410bd6d06deba97
humanhash: beer-asparagus-oregon-nine
File name:doc.intesa_sanpaolo_payment_advice_copy_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:39'936 bytes
First seen:2022-02-09 10:29:03 UTC
Last seen:2022-02-09 13:00:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 384:myu0gIg0ciXoF8A0tX0YScFGff0agD16rGTNl9ZLfuux7iHXu6Ggg8T0LvNesxCq:n8RiXuTeXdFFGfs6rk95uux7qXMa4Eq
Threatray 19'440 similar samples on MalwareBazaar
TLSH T1F403D402F1598371D3A75A7FE8DEB04CE296891D0107E99AF0163F4C1A233E5ADFA59C
File icon (PE):PE icon
dhash icon 64e4c8d0f0e8d4d4 (56 x AgentTesla, 7 x RemcosRAT, 5 x NanoCore)
Reporter lowmal3
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/239418/
Detection(s):
SecuriteInfo.com.W32.Jigsaw.A1.genEldorado.5136.22562.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Running batch commands
Sending an HTTP GET request
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/62039773845a69d773512626/reports/a10c0e52-2573-400a-be95-bf8c06daf6fa/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ee86f535-6fd2-4774-8086-12977b495221
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/936742
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 10:29:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsrmfsewhd53e3zebke5hicy5b5hd4ou7tzttpzrxx33gvhyik6q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a7682c0607e0fcb3580d28aec0e3439d6eae0cde1ab3359832046f7f33cdb0f
AgentTesla
245f10bd87db63dab02528af1be27f84be2be58aee091227a3c3b5c4373f08b9
AgentTesla
4bb6d08dad879c7e0098024d645c92c198484e1d7703019fa0db7ead6f867bfd
AgentTesla
599ae5be5a7d40330aa098c54721609fcbd05039755904015fab880b4b8502b9
AgentTesla
96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458
AgentTesla
ab5e531c49ff91e17814ab2974a20b7b141b42b1d0229e27b20713358effd633
AgentTesla
b3705dc14785978cfa26ca25bdda43e5a66286fd2970b2d839b9b2bec4064717
AgentTesla
c2672e6fd55b129125a19c7837943c0844c03ec02dcf165af183f9e4df4dccbc
AgentTesla
f4b4716fd756e090bc988dc4ca0ad23bdf22a238c3d1b4a329582fb936e8ee92
AgentTesla
+ 19'430 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220209-mjbkxsabfn/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd
MD5 hash:
9f494167636f0baae410bd6d06deba97
SHA1 hash:
e9e3f6bc7ea2acca794563165f8a7e9dcc17c885
Link:
https://www.unpac.me/results/50b9f305-874b-491b-a809-817665aea2c4/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5ca2c2c89638/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 5ca2c2c89638fbb26f240a89d3a058e87a71f1d4fcf339bf31bdf7b354f842bd

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/239418/

Comments