MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3
SHA3-384 hash: 33af64068695a918d40ce0da64291014b6f78a6bcc3cdbce4653fcd5bd9a7c1d689ef5219437d193c2ba17936be57bca
SHA1 hash: b71eec877de7e9a86c98a45b5183e2eaa8b95d70
MD5 hash: 3570740c6ac3ae2a608e63f1a167d988
humanhash: orange-speaker-leopard-kansas
File name:DHL EXPRESS doc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:569'344 bytes
First seen:2020-12-22 12:43:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:DCtUQgJ2NiJLgLlw8HHKYSJxsSYGlYF9o2K6Oa6UL:DCtU9J2NmLwlwMSJx4XF9oW6U
Threatray 1'958 similar samples on MalwareBazaar
TLSH 3DC4DF5032B85F4BD6B88BF91872504023F6366B643EE29C5FD1B2DF1CA2F484695B63
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloud.tihest.org
Sending IP: 50.31.134.128
From: DHL Express <customer_care@dhl.com>
Subject: DHL express delivery
Attachment: DHL EXPRESS doc.zip (contains "DHL EXPRESS doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL EXPRESS doc.exe
Verdict:
Malicious activity
Analysis date:
2020-12-22 12:49:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/953aaa4c-243a-4d43-8825-7ce2e33b540e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/108870/
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.REMCOS.SM.6084.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/568369
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 333253 Sample: DHL EXPRESS doc.exe Startdate: 22/12/2020 Architecture: WINDOWS Score: 100 66 Found malware configuration 2->66 68 Multi AV Scanner detection for dropped file 2->68 70 Sigma detected: Scheduled temp file as task from temp location 2->70 72 12 other signatures 2->72 7 kprUEGC.exe 5 2->7         started        10 DHL EXPRESS doc.exe 6 2->10         started        13 kprUEGC.exe 2 2->13         started        process3 file4 74 Multi AV Scanner detection for dropped file 7->74 76 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->76 78 Machine Learning detection for dropped file 7->78 80 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->80 15 kprUEGC.exe 2 7->15         started        20 schtasks.exe 1 7->20         started        22 kprUEGC.exe 7->22         started        38 C:\Users\user\AppData\...\dZECRCvyGeP.exe, PE32 10->38 dropped 40 C:\Users\user\AppData\Local\...\tmpD70E.tmp, XML 10->40 dropped 42 C:\Users\user\...\DHL EXPRESS doc.exe.log, ASCII 10->42 dropped 82 Injects a PE file into a foreign processes 10->82 24 DHL EXPRESS doc.exe 17 5 10->24         started        26 schtasks.exe 1 10->26         started        signatures5 process6 dnsIp7 44 elb097307-934924932.us-east-1.elb.amazonaws.com 54.235.189.250, 443, 49741 AMAZON-AESUS United States 15->44 46 nagano-19599.herokussl.com 15->46 48 api.ipify.org 15->48 32 C:\Windows\System32\drivers\etc\hosts, ASCII 15->32 dropped 54 Tries to harvest and steal ftp login credentials 15->54 56 Tries to harvest and steal browser information (history, passwords, etc) 15->56 28 conhost.exe 20->28         started        50 smtp.ritac-eg.com 13.248.196.204, 587 AMAZON-02US United States 24->50 52 192.168.2.1 unknown unknown 24->52 34 C:\Users\user\AppData\Roaming\...\kprUEGC.exe, PE32 24->34 dropped 36 C:\Users\user\...\kprUEGC.exe:Zone.Identifier, ASCII 24->36 dropped 58 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 24->58 60 Tries to steal Mail credentials (via file access) 24->60 62 Modifies the hosts file 24->62 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 24->64 30 conhost.exe 26->30         started        file8 signatures9 process10
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 12:44:05 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocuyw4l4ebtlyuuzlnxewoyzi3iezhxouoqpu3jofpy4jablc7rq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
55948fede55c398fce76d97b8316d5da6f958b08746a33f0cdaf4e016f0a1e15
AgentTesla
6047a91d032880e1ea8040478c47524e3940f786fcb4e2708428e9db81fb559e
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
b457e5f6faf9eb8c70d0350ff57869f011cd1c4abdf6db5d6335797e33ae7d10
AgentTesla
badf7e8ef826b51aaa028ec3a296f7b9432474d8b6377552f0dcbfd520c0df47
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
c9747168a0090d1b036e820b6e51b1983deded573227547901baa71f5914c7cc
AgentTesla
e6efc787bb6b6506150aca14be1966713c7a28f55788af42902e500779818228
AgentTesla
f36eeb335a9d18ff16f6b1869f45a0f81d44f93706fd2d39d4568d8d2e694ca3
AgentTesla
fdac92b0fe7d038bfdfa12127cae944e95dff1ef54684923785701d9e92dfaf4
AgentTesla
+ 1'948 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201222-aldph7j21a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Drops file in Drivers directory
AgentTesla
Unpacked files
SH256 hash:
70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3
MD5 hash:
3570740c6ac3ae2a608e63f1a167d988
SHA1 hash:
b71eec877de7e9a86c98a45b5183e2eaa8b95d70
Link:
https://www.unpac.me/results/0ea35e99-4fe6-4920-9b6c-9054d406b0da/
SH256 hash:
4575cb072f9f9a57020aa9b573e36bbdef73399cf5cd6bee848bba697b1c1876
MD5 hash:
30a30e46c5f2123e2582557f224b4335
SHA1 hash:
49bde7825ce8833bacd7b22709e18e314bf128df
Link:
https://www.unpac.me/results/0ea35e99-4fe6-4920-9b6c-9054d406b0da/
SH256 hash:
fc0d1d437519b84d47fec69baa0190a35f253ed61448faea76d2887f8856521b
MD5 hash:
54dfcc064042494c3863e90290f62667
SHA1 hash:
860bd6e2aaa96ad0f7c59f7ffa5673a62390f928
Link:
https://www.unpac.me/results/0ea35e99-4fe6-4920-9b6c-9054d406b0da/
SH256 hash:
1a945b958822f6b82ca4bd36e21ba8b8d918fbab83f03ac221a0204fb199d331
MD5 hash:
a58d2a7f44abecd6c99d501d812dcc0d
SHA1 hash:
97257f77a512704aee44d1a283bc67a51d9071c9
Link:
https://www.unpac.me/results/0ea35e99-4fe6-4920-9b6c-9054d406b0da/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b1a2c93142106678652e84f1c7b6cb10d9f374e43f63ab69e9f20fd900892d8c

AgentTesla

Executable exe 70a98b717c2066bc52995b6e4b3b1946d04c9eeea3a0fa6d2e2bf1c4802b17e3

(this sample)

  
Dropped by
MD5 27c3f7503aa0a14e947f1a90537bfbd4
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 b1a2c93142106678652e84f1c7b6cb10d9f374e43f63ab69e9f20fd900892d8c
Cape
Cape
https://www.capesandbox.com/analysis/108870/

Comments