MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320
SHA3-384 hash: 04fe88726b364b9c7a706f9aae55660fb6bd300a866c57f87d91e7caf9f9197dd132236eb6ba9c200ee4b03501d7aaf5
SHA1 hash: ec9b7f5769f962d8d3e7ea4ad3dfc4ef54104214
MD5 hash: e5c7f3a708aa0582a476ac4394806bc1
humanhash: green-victor-paris-early
File name:Purchase Order-992647.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:721'208 bytes
First seen:2020-10-02 09:28:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 12288:ZD4fqRBdy4r3XyMb6U0t9Oi3d6iur4zuaMQJBBBDsEVt8n3dPizoeeDUIg8Z:BfdNXPmzdarNaMQ3slPizteDUIg8Z
Threatray 172 similar samples on MalwareBazaar
TLSH C3E45B54E483596ACF6DF3F980A380B8A9661586F7E0CD39B1C977381D1721BA32D12F
Reporter abuse_ch
Tags:AgentTesla exe MailChannels


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: iguana.birch.relay.mailchannels.net
Sending IP: 23.83.209.253
From: sales2@nixcli.xyz
Subject: Re: RE: Purchase Order
Attachment: Purchase Order-992647.zip (contains "Purchase Order-992647.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/67708/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/480109
Signature
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 06:08:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwoigybgwhxdkpawlbdqlacicxvdk5izwrdnwnucf62ax3k2wmqa._file
Verdict:
unknown
Similar samples:
31e9e7ca798fc5177eb571c001d4d7ae44e141818fa31fb8fe654d44afe3df53
AgentTesla
69842a6dc654dfc2d3a69b566e90679318cbac7209d4286df9af58b8e173ab90
AgentTesla
8c6c41d8e0f478b1be11b938bf83066e8cf7a8b294c18c91e0b2570f464bc6d2
AgentTesla
a4b6103b1dfe717301995f598b140b0ce26e7a1541f45b6ed6485c05dca2692a
AgentTesla
b796ebc23a355b8fbd29552b2ff7142f09617c25a30a33d5a92626f69e337d48
AgentTesla
c62ef08103c30d5d2d18fbc2eff820985af40aa377828ef72c3ecad495103511
AgentTesla
cbc1369ce8647d37acabe75a2a8b62f771d0e2f803f0c5eb04e807a1603426e4
AgentTesla
d44272fe83f10383b50e8268ffe5f7f70e1c2b355363ccde038172f6a9eb5479
AgentTesla
f4e60792b136f02c28fd35322ee58bf723aeaa3611d286417d8b2b0707612cdc
AgentTesla
fbe07dca7476dba15e9dd639c2b5a71c6bbdf21b0f50ee1fde6aa5bc13e19243
AgentTesla
+ 162 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla
Link:
https://tria.ge/reports/201002-fraffa69mn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320
MD5 hash:
e5c7f3a708aa0582a476ac4394806bc1
SHA1 hash:
ec9b7f5769f962d8d3e7ea4ad3dfc4ef54104214
Link:
https://www.unpac.me/results/4a6e93eb-4793-44dc-b79d-d80244737f71/
SH256 hash:
0a890c460a2520b44b6730f6b36720e95cb3a37081acbebcaf83e8da6e124f76
MD5 hash:
3d007a4ab02232351205081a1e4cb345
SHA1 hash:
5d6bb09bdb73a259278be156e019f3af8ae68d06
Link:
https://www.unpac.me/results/4a6e93eb-4793-44dc-b79d-d80244737f71/
SH256 hash:
b80155dbd80f8bc5d3f59e08df47aefa42e73612aac6e8845fad3cae516cbdb0
MD5 hash:
0478256ba4237f2e33b77f8127d9a145
SHA1 hash:
560f2cd098bd81c18174d980652b28a8c90c48e2
Link:
https://www.unpac.me/results/4a6e93eb-4793-44dc-b79d-d80244737f71/
SH256 hash:
d065744c83c37b059fd345011b6c21297a5de8bc5ebbc93f05add6315bee770a
MD5 hash:
17d8bbf85363bf3ca0f6b4d0154dfeb7
SHA1 hash:
6295dcb6bfd8907d47b3db14d0d4b230c4f07186
Link:
https://www.unpac.me/results/4a6e93eb-4793-44dc-b79d-d80244737f71/
SH256 hash:
89d887ef97fa06764dba6d739b035936d889359bb0eb550ec43ce54d31511076
MD5 hash:
0186f869cba491f3f08b674a23b3e03a
SHA1 hash:
6722e5a22e5a9dbdf2d12e9a381f1e9beea70d94
Detections:
win_agent_tesla_w1
Create hunting rule
Link:
https://www.unpac.me/results/4a6e93eb-4793-44dc-b79d-d80244737f71/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b1b3263286f2d0317bb86296507ba4b182b9a775844fb0c2e16925ff9fde0de2

AgentTesla

Executable exe 659c836026b1ee353c16584705804815ea357519b446db36822fb40bed5ab320

(this sample)

  
Dropped by
MD5 99fdae94bc300c42989a89f519d6b78b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/67708/
  
Dropped by
SHA256 b1b3263286f2d0317bb86296507ba4b182b9a775844fb0c2e16925ff9fde0de2

Comments