MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c78a32328d131b8e75b30321d925c1e11d38416e744329d4a333822e4cfb7ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c78a32328d131b8e75b30321d925c1e11d38416e744329d4a333822e4cfb7ec
SHA3-384 hash: 9ed44760565e100022822e2fe32f9d251beeff52643e1e20c2c3d3210fd63062841b6909d36c94e98cdc3e926c53f622
SHA1 hash: 9ac39bf5017c6d23433723b55d869856e138e54d
MD5 hash: 2aecc1b520754fc969b230fe021f1889
humanhash: two-kitten-helium-beer
File name:Our Ref MIDLGB31 (2).exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'162'752 bytes
First seen:2020-08-10 09:56:23 UTC
Last seen:2020-08-10 11:07:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:91u5An/g8ObWwWFBu3k69FUXM6N6T4epDXsmPA+6Wb8fGFBzgrpiAiP7r9r/+pph:fu5O/g8LCKM64UuDvA+6WbPFCQAi1q
Threatray 42 similar samples on MalwareBazaar
TLSH 7235BE86E58C7F94CCB89B70673ADAF08316BDA95831D11C29CD3D673AFE2937015292
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hsbc.com.vn
Sending IP: 103.99.1.149
From: Hieu T M NGUYEN<hieunguyen@hsbc.com.vn>
Subject: Ref: Confirm Remittance
Attachment: Our Ref MIDLGB31 2.zip (contains "Our Ref MIDLGB31 (2).exe")

AgentTesla SMTP exfil server:
mail.framafilms.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42653/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.406.27344.5529.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/416718
Signature
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 260777 Sample: Our Ref MIDLGB31 (2).exe Startdate: 10/08/2020 Architecture: WINDOWS Score: 100 30 Yara detected AgentTesla 2->30 32 Yara detected AntiVM_3 2->32 34 Machine Learning detection for sample 2->34 36 2 other signatures 2->36 7 Our Ref MIDLGB31 (2).exe 3 2->7         started        11 BAVLA.exe 4 2->11         started        13 BAVLA.exe 3 2->13         started        process3 file4 28 C:\Users\...\Our Ref MIDLGB31 (2).exe.log, ASCII 7->28 dropped 44 Writes to foreign memory regions 7->44 46 Allocates memory in foreign processes 7->46 48 Injects a PE file into a foreign processes 7->48 15 RegSvcs.exe 3 7->15         started        18 conhost.exe 11->18         started        20 conhost.exe 13->20         started        signatures5 process6 signatures7 50 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 15->50 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->52 54 Injects a PE file into a foreign processes 15->54 22 RegSvcs.exe 2 6 15->22         started        process8 file9 26 C:\Users\user\AppData\Roaming\...\BAVLA.exe, PE32 22->26 dropped 38 Tries to steal Mail credentials (via file access) 22->38 40 Tries to harvest and steal browser information (history, passwords, etc) 22->40 42 Hides that the sample has been downloaded from the Internet (zone.identifier) 22->42 signatures10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6c78a32328d131b8e75b30321d925c1e11d38416e744329d4a333822e4cfb7ec/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 09:58:11 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nr4kgizi2ey3rz23gazb3es4dyi5hbaw45cdfhkkgm4cfzgpw7wa._file
Verdict:
unknown
Similar samples:
1eb80076d32a7919086f64f0fd8bbb87f2116992719c9d67e679f3c76a2e9392
AgentTesla
68ac6f6254e62bc5285579d1027024a8b63f8370ece4e134361264ff53cc2294
AgentTesla
740b6b0b89699a05d2f6e7ea28930260ad62259c4f94eb917cf3120e25edf07e
AgentTesla
7f09e1a23ce7b3b143221cd5f8be274e0b75380e6b3dd8e32d947c6f3b493104
AgentTesla
8fb8a337b94a64f00007322440c49dbcb8cc3f16c719cba78094812e487b5e95
AgentTesla
a7118b5327e01dc08fae4ab228e1ae2920dde4df42232fa8062eaf90066b3f7d
AgentTesla
c3653e5318419f8107d8bcc07a26f01681a189a5f448c417d99bed49b4131ebf
AgentTesla
e0832a1f553c7fb2766cd743aefc05bbff71cd5a0c6737d9e65d784d7c8ac2de
AgentTesla
e716a6275c285005eba76a08091ef155b7cff1bc0c417b14856e1a9bf47f0db1
AgentTesla
f8238f8f8e66a8a79ac7e5e9f694137ff09f691a6f62284359696ac84ec63b78
AgentTesla
+ 32 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer persistence spyware trojan family:agenttesla
Link:
https://tria.ge/reports/200810-n84xpv1zxj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of web browsers
Reads user/profile data of local email clients
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6c78a32328d131b8e75b30321d925c1e11d38416e744329d4a333822e4cfb7ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e3afa6bdd57ef6d0c322198de7b83fcb8cc96fe666e875a42502443c251465db

AgentTesla

Executable exe 6c78a32328d131b8e75b30321d925c1e11d38416e744329d4a333822e4cfb7ec

(this sample)

  
Dropped by
MD5 92151d9c5f9cc46978dbb28cf093f2e6
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/42653/
  
Dropped by
SHA256 e3afa6bdd57ef6d0c322198de7b83fcb8cc96fe666e875a42502443c251465db

Comments