MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6ce82de9b05b1a5e2cee73e45292f3e06aa8df33c904724ea5f5bdd536d44c39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 4
| SHA256 hash: | 6ce82de9b05b1a5e2cee73e45292f3e06aa8df33c904724ea5f5bdd536d44c39 |
|---|---|
| SHA3-384 hash: | 89bbd6094b6bcf176c6a6404d973a215f888131363be424775dd2cab329ec8ef5bd9d722412663b898217f78bb72d319 |
| SHA1 hash: | 6b7eea7cbd16d537092f6d4cccbc08e5244935ed |
| MD5 hash: | 2d7fc68eff99629ccdc020836ad92cb3 |
| humanhash: | violet-massachusetts-three-pip |
| File name: | IMPORTANT INFORMATION.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 764'416 bytes |
| First seen: | 2020-04-15 17:22:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f416e03d2a665802235eb54288d771a4 (1 x AgentTesla) |
| ssdeep | 12288:+H/o99KDQOOqS1COqIkjFJeOSq2gvfvXsV9bPjWjQhiauTIBABSu:QgeDGqJJEPzmfvXMZkmuT2ABSu |
| Threatray | 11'276 similar samples on MalwareBazaar |
| TLSH | 35F4B023F2E05873C35A163ECD5F9768A82ABE112D2826872FE41F4C9F3975139351A7 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla COVID-19 exe |
abuse_ch
COVID-19 themed malspam distributing AgentTesla:HELO: pascargousa.com
Sending IP: 103.99.1.159
From: no-reply@pascargousa.com
Subject: COVID19 ANNOUNCEMENT #002
Attachment: IMPORTANT INFORMATION.r00 (contains "IMPORTANT INFORMATION.exe")
AgentTesla SMTP exfil server:
smtp.yandex.com:587 (77.88.21.158)
Intelligence
File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-04-15 15:50:28 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
28 of 31 (90.32%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
agenttesla
hawkeyekeylogger
Similar samples:
+ 11'266 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoCreateInstance |
| WIN32_PROCESS_API | Can Create Process and Threads | kernel32.dll::CloseHandle kernel32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryExA kernel32.dll::LoadLibraryA kernel32.dll::GetSystemInfo kernel32.dll::GetStartupInfoA kernel32.dll::GetDiskFreeSpaceA kernel32.dll::GetCommandLineA |
| WIN_BASE_IO_API | Can Create Files | kernel32.dll::CreateFileA kernel32.dll::FindFirstFileA kernel32.dll::GetTempPathA version.dll::GetFileVersionInfoSizeA version.dll::GetFileVersionInfoA |
| WIN_REG_API | Can Manipulate Windows Registry | advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA |
| WIN_USER_API | Performs GUI Actions | user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::FindWindowA user32.dll::PeekMessageA user32.dll::CreateWindowExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.