MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 748f95bbe782312ba99757f051813a0f4a21635d02becbf05f4d83f7434643f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 748f95bbe782312ba99757f051813a0f4a21635d02becbf05f4d83f7434643f3
SHA3-384 hash: 5823cb7fb3b9bc8e8d9fca28883a5268d94cb93d3394df848a3d91cddb8553cb8104e346cbb44eee8715cb2408d500de
SHA1 hash: 6c334767c50fafb6dc9c99438fb669ddcf5a0312
MD5 hash: 2b5c4561c0ef24f29760741bb31e8976
humanhash: oxygen-london-spring-stairway
File name:SHIPPING DOCUMENTS.EXE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:502'272 bytes
First seen:2020-09-16 11:12:45 UTC
Last seen:2020-09-16 12:17:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c458ff2d515beb8f44158cd3636a7400 (19 x AgentTesla, 6 x NetWire, 3 x HawkEye)
ssdeep 12288:x73bk0H7QSv4Qv5GGExZzsDBveNKwz2uZnooGHC3v3F:bHEm4m5GGEx2lveJPSUvF
Threatray 9'484 similar samples on MalwareBazaar
TLSH 62B423C4EC0904C6F988A971C57E6651CB263C339D1BF87A8C9FD41A2B76BC69713B81
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/61932/
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/467727
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/748f95bbe782312ba99757f051813a0f4a21635d02becbf05f4d83f7434643f3/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 08:51:49 UTC
File Type:
PE (Exe)
Extracted files:
115
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oshzlo7hqiysxkmxk7yfdaj2b5fccy25ak7mx4c7jwb7oq2gipzq._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
agenttesla
Create hunting rule
Similar samples:
173a06105b6617e5c7015ee0c49b8a0442aacc4a9581b8c13d2606677be532ae
AgentTesla
38de2a27f6860ff3215434f3088f37ffc36c3a487fbfcee619bd1af281883624
AgentTesla
48a05e42214277f9a4fe66017f03cce54570e22aab74cc8aa7e0a66ec4d3d4d3
AgentTesla
537138289e71224816b26b83db4b7d5fe1021e7b915bb512bdb99b8ae5969aae
AgentTesla
73424ee75d42584b3750894ba850e11bea9a790b430961e4497ff69bfd2fdc62
AgentTesla
99fa917c6f97756ac7ced3ca06142728178550f72be70326ab30420fd4e9797e
AgentTesla
e111f55125b49b9f9f07fecc8f6506062248511cda75a4428b677536db0df8d1
AgentTesla
e5a881a192dcbc6434585a8a1fa4745488f092b9713945def86fe6c2a87de5fd
AgentTesla
f64f6cdf34223961fe65653d8fd5d66dc2fdc3e5d56422cdc5923765f78cf47d
AgentTesla
ff339c6387678ac6ad9e7403a579d0d52dbac97e94b65d0a6a1ea852bd10673a
AgentTesla
+ 9'474 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/200916-ekxxej6v46/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/748f95bbe782312ba99757f051813a0f4a21635d02becbf05f4d83f7434643f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 8ef46f4834babf8a9c56a8e9f04c202c765edf1a0c718fbe1eb8d95ab03ab7ff

AgentTesla

Executable exe 748f95bbe782312ba99757f051813a0f4a21635d02becbf05f4d83f7434643f3

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 8ef46f4834babf8a9c56a8e9f04c202c765edf1a0c718fbe1eb8d95ab03ab7ff
Cape
Cape
https://www.capesandbox.com/analysis/61932/

Comments