MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a
SHA3-384 hash: faedc9af78629a23900a0159a9532311f91663e91c5bd5bec9f9b360d0a2c1e19bb30fed162ac5c53e85b6d2b02bc1a5
SHA1 hash: 6937893fe6da1db541a564f0d90a7ba087f73a73
MD5 hash: f369d2545e17973c6d10f9d763c363c0
humanhash: four-robert-wyoming-leopard
File name:id2o1whB19hUuSG.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:475'648 bytes
First seen:2020-06-29 06:04:35 UTC
Last seen:2020-06-29 06:45:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:kGVGRo7+SSm8LH1zs/pWQ/CtLrVgzcudMEaJKdrcHsdiHW+mb4FHSkm2WdQMoQB7:kG0Ro7+BVQIQ/C5/zgZXkt5mh
Threatray 10'644 similar samples on MalwareBazaar
TLSH 44A4F12117D9A619E2BD0B3C5762220047B666233553F32D6BC5B2F91C73BE14B22BE7
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.beeinspire.com
Sending IP: 115.124.125.172
From: Prakash International Pvt. Ltd. <raj@prakashchemicals.com>
Subject: Hello Sir/Madam
Attachment: Purchase Order.PDF.rar (contains "id2o1whB19hUuSG.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15338/
Detection(s):
SecuriteInfo.com.Generic.mg.f369d2545e17973c.31799.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:06:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxc6ci2pdzldsxarocivt3wxoyyp6dyytiaouuvkwfk4c6rgwena._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
119d0e520473bf8e440f8d993206427b0379497442c37b4388419e19ae498056
AgentTesla
3b42a378cd7279c28767cf421cd3dec7562e5880bc42b3b9079303849e3e62c8
AgentTesla
540fb0a9343fb743aa4457f9bdc358aa96786caa54b15597ab5e3e419662f1bb
AgentTesla
5761ed082c15df8c9fb6fadcff317a227008848db681d92ae959fe481e05e212
AgentTesla
7013e2ac13e42bbee07bb06c5f9c2e4b625a6599a64bccf0e844ba2e995e0737
AgentTesla
867979993b4e58bf11e73e11655e50ca97b55e91322e744b29241d3a47b7dcd2
AgentTesla
a5d81b3d4d0df91d286ae0f3db7d166ecd013e8c53d1677be5b149edb9d15d42
AgentTesla
a9a90e322d043cf6430fb070d2cf81ea38b36b174add5b06c3d8691c6c605949
AgentTesla
ccb65f79de018225e7ca824cc70f81726e771019e53785d7a2a3772548fcfa23
AgentTesla
e83b98a736b614af8adb721b387d5eda8d794c6fd58296a59a86c6faf9baf4ba
AgentTesla
+ 10'634 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/200629-wbsz4tzr9x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Reads data files stored by FTP clients
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e1f96226fe7ca734364af8e5af90ef3be47aa52a6236bfbce9199039e4b945d0

AgentTesla

Executable exe 75c5e1234f1e56395c11709159eed77630ff0f189a00ea52aab155c17a26b11a

(this sample)

  
Dropped by
MD5 a19da93b46f1fe01a1d54fb138291637
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 e1f96226fe7ca734364af8e5af90ef3be47aa52a6236bfbce9199039e4b945d0
Cape
Cape
https://www.capesandbox.com/analysis/15338/

Comments