MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75c0601db308796a7e8b5f045f908dd910a4a869cc53d544ed28726ad0eb0537. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75c0601db308796a7e8b5f045f908dd910a4a869cc53d544ed28726ad0eb0537
SHA3-384 hash: e429459e54c506b4763639e7b7e6f11125537e36dcaf1c68e1e1b1eb0d9f8e7deea285e746fb955f4feaba74ef828f60
SHA1 hash: 7795bbdef40832cee08256ebe1cca0c6df8bc740
MD5 hash: 7d7c9f126169d3ad991f2b511b466e47
humanhash: hydrogen-double-lithium-steak
File name:11203780.msi
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'656 bytes
First seen:2020-06-30 12:08:34 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 12288:qEoQu4d53qOj2bbdaGJSLuz+M//IbVbP8n:qEocdFqOy3daqS6aM//aVbPY
Threatray 10'674 similar samples on MalwareBazaar
TLSH 9FA4F118325CA833CEBC41F68492A12007B59CB53582F7DA9DCD71E819F7BDD4712AA7
Reporter abuse_ch
Tags:AgentTesla msi


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic315-15.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.125
From: ALOROBA.Cont.Co. L.L.C <d_rojas.borgatta@yahoo.com>
Reply-To: ALOROBA.Cont.Co. L.L.C <hunt-greg@hotmail.com>
Subject: INV&SWIFT E20/001828 GWENT
Attachment: 11203780.xls

AgentTesla payload URL:

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17106/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75c0601db308796a7e8b5f045f908dd910a4a869cc53d544ed28726ad0eb0537/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 12:10:06 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
10e04c6d2244a7e905d1994ef3108615c2df388976ae62cb856f2ae2e59b09fd
AgentTesla
1a4dea5eadd7dd451ad9a13ba19fce11b26e33e0a730662fb39147ea7f0b94bd
AgentTesla
1eeb2016c83b430e5e444f7dade67a84d441061180087ac57eb8f89d196d4773
AgentTesla
35912ff3b78d0699082450202cc16cec5c11447c39ec0e4db7738c188662f0c5
AgentTesla
369da6c535b8119d4b66593951b4b7939550e4454f9514869c408487a73634cd
AgentTesla
423c8c0b4eb6fc15b614326190cbd2b932f5480fdc1791ca9c03dc696ef61b31
AgentTesla
631ad58270a0b7af59291eb3c0c4b20752cbfc64a0652f39f62bf06e15971789
AgentTesla
93be03ee9522ffc9ea73dcf74bac994a5eabf6f373c0536f5c718af8ff819995
AgentTesla
dab8c3350d525d66785c80647dd39cac8fc981c7a18c66b8bea5526926c6aad6
AgentTesla
f15d580cc1e0b17070f7fe48cb8d8a60177e4e8468d5b5f2008e6be5c3a85b42
AgentTesla
+ 10'664 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla persistence discovery
Link:
https://tria.ge/reports/200630-3wddv8b2r6/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Suspicious use of SetThreadContext
Modifies service
Enumerates connected drives
Checks for installed software on the system
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Excel file xls 7c3822b0015e740bb3e9a1c4d0d5da368cae8117a820152377d41de49ff3ca36

AgentTesla

Microsoft Software Installer (MSI) msi 75c0601db308796a7e8b5f045f908dd910a4a869cc53d544ed28726ad0eb0537

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/404634/
  
Dropped by
MD5 14b2d3f08ad6543c060d19748f526167
  
Dropped by
SHA256 7c3822b0015e740bb3e9a1c4d0d5da368cae8117a820152377d41de49ff3ca36
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/17106/

Comments