MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 664b69b27e77e1458d7fff94e384830b0e6e63b29d3ca5a3babf07c942333b5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara 3 Comments

SHA256 hash: 664b69b27e77e1458d7fff94e384830b0e6e63b29d3ca5a3babf07c942333b5f
SHA3-384 hash: 76be4cdddce0d862b640d59857b0e9e88c653fcf2dae6c525654eb2a16c1502513960781255e609590933968ee81e3fc
SHA1 hash: d5ba16fd8e51397a19c24c20c022a62f4d8637d7
MD5 hash: fb6f39487961ff0ab1772bae6eec5704
humanhash: hawaii-lamp-black-thirteen
File name:Recibo del envío.exe
Download: download sample
Signature AgentTesla
File size:1'040'176 bytes
First seen:2020-06-30 13:06:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:QQNQkPP8yQlBuyP7U3nkPc8P7cDnYWAwk5EpPOwlT/0TUC3BFK7hGSnBF5RfQ8G/:QQNn8lP+nyc8CXdNKLK7sSnjoX
TLSH 08252A1EBE88E915C12D5532C4EAD5602371BC8A6723CB0F3AC57F4E3E323572D5A25A
Reporter @abuse_ch
Tags:AgentTesla DHL exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: dhlonline.gleeze.com
Sending IP: 2.56.8.129
From: DHL EXPRESS <import@dhlexpress.top>
Subject: Aviso de llegada del envío
Attachment: Recibo del envío.rar (contains "Recibo del envío.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 34
Origin country FR FR
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17185/
ClamAV SecuriteInfo.com.CAP_HookExKeylogger.32352.29820.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/664b69b27e77e1458d7fff94e384830b0e6e63b29d3ca5a3babf07c942333b5f/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 13:08:09 UTC
AV detection:21 of 31 (67.74%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-5akn487dtn/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 27.78%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 664b69b27e77e1458d7fff94e384830b0e6e63b29d3ca5a3babf07c942333b5f

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments