MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e7ab36ec389a4294220c2b5535e8389fcb1acbd09b7a87dbc2e924ee54544b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	5e7ab36ec389a4294220c2b5535e8389fcb1acbd09b7a87dbc2e924ee54544b6
SHA3-384 hash:	b82c3a0951ed7eb1449b8f92352e876d02cf4b69f2a897b1fd72b3b4566ad96045aefe9d9127efdf701460b9a0352d8e
SHA1 hash:	1e062d18a8bbbb676794309dc65726b687fffc3e
MD5 hash:	b5f59cd518097113d94a7f076d4fe846
humanhash:	emma-batman-earth-burger
File name:	mixtec new order and price list request for the month of december_pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'160'192 bytes
First seen:	2020-12-02 07:05:19 UTC
Last seen:	2020-12-02 09:04:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	24576:MEx0vSfaVmy1aZPROQubaDUHEw2Rcs+BSC2KVyveMhhST0sDdaA3:M/CaVmhZodWwHEwB4IyveM6T0AdaA
Threatray	1'697 similar samples on MalwareBazaar
TLSH	AA358DB5AF444425F4765B3C84B16593A56FAF8BAB07C81D28B27ACE6F3374344C242B
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/106331/

Detection(s):

SecuriteInfo.com.Generic.mg.b5f59cd518097113.28010.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/553253

Signature

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses the Telegram API (likely for C&C communication)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5e7ab36ec389a4294220c2b5535e8389fcb1acbd09b7a87dbc2e924ee54544b6/

Threat name:

ByteCode-MSIL.Backdoor.Remcos

Status:

Malicious

First seen:

2020-12-02 07:06:09 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lz5lg3wdrgscsqrayk2vgxudrh6ldlf5bg32q7n4f2je5zkfis3a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

0f20eb4400b00c0698e5f24ca1541203eab68f6104aa15e8002bf845b0326076

AgentTesla

113a77824329e62d8a2268075f4e8afa9756a9e134d46e87a61618d7b426b9af

AgentTesla

199da37d02aa71c502adf3a623de188b25f7cb2001b4936a798ea8a6a9c20ad3

AgentTesla

1a491366f51516a92c36a9adf1db7c9c18ee6ae24bb18b4a296d0e1d0f81912e

AgentTesla

69b99d16f072c6ab2687da255681f3f1c3a97746bfe516b206644a5056a99425

AgentTesla

6c172122db5af54bec6f1a6255169ff95ddebce78bc550814c701ef7e2664f58

AgentTesla

8f41da0e0362bc2485f17cff5b8b5e40a3790dbf4f53015d1d02f37906e4be42

AgentTesla

9bad59a7b2c604957e6dc7f52dbebcaf6b240eba426bdd2e973625cdd6c50c50

AgentTesla

d5a2e34a8816a75fe9d6cd9b9035040ea5777429dc7eeebc0ebb7f8a4d897495

AgentTesla

+ 1'687 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/201202-hjnyyzssdx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Unpacked files

SH256 hash:

5e7ab36ec389a4294220c2b5535e8389fcb1acbd09b7a87dbc2e924ee54544b6

MD5 hash:

b5f59cd518097113d94a7f076d4fe846

SHA1 hash:

1e062d18a8bbbb676794309dc65726b687fffc3e

Link:

https://www.unpac.me/results/5fc108b0-8877-422b-9ae4-b02c8d3a5c32/

SH256 hash:

9584f6d01e6452371cc9b4828030a13045d99c243c497b63628828e66aabe26f

MD5 hash:

7476e403eef14ac403c63c7279831780

SHA1 hash:

8387f558e30dc115987ac2b5c174a41302471abf

Link:

https://www.unpac.me/results/5fc108b0-8877-422b-9ae4-b02c8d3a5c32/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Remcos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5e7ab36ec389a4294220c2b5535e8389fcb1acbd09b7a87dbc2e924ee54544b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.