MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185
SHA3-384 hash: d3b4c1d95f97f32ee33f254f71ed851b5fe2c4fc870bcd9f0f7f09a75121c6ecec8af7e54ec4cb9624c8bc451c6bdffc
SHA1 hash: e089cfbf00e49c93b494a05b682bf64bbb9273e6
MD5 hash: 2a5b1193eb4cbda768e150c94e666195
humanhash: romeo-arkansas-oklahoma-spring
File name:Cotización.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'064'960 bytes
First seen:2020-10-10 06:54:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:R/EN2c2hwo55A9VTjkx/7rKI2rtBogKpEugw7FPyZ63wmsqPI3YP+xKijPY9LTBr:WE9Oo55ATTq/nV2rTozybI3wmsqv
Threatray 948 similar samples on MalwareBazaar
TLSH BD354AAD326072DFC86BC972CEA81C64FBA0747B931BC207901715ADAA4D997DF141F2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: outmx-267.london.gridhost.co.uk
Sending IP: 31.170.120.152
From: Comunicado <comunicado@sys-prontius.com>
Reply-To: Comunicado <Ventas@imagencolor.cl>
Subject: Re: Cotización
Attachment: Cotización.r00 (contains "Cotización.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69702/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Launching a process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/487414
Signature
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 296151 Sample: Cotizaci#U00f3n.exe Startdate: 10/10/2020 Architecture: WINDOWS Score: 76 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected AgentTesla 2->21 23 Yara detected AntiVM_3 2->23 25 2 other signatures 2->25 7 Cotizaci#U00f3n.exe 3 2->7         started        process3 file4 17 C:\Users\user\...\Cotizaci#U00f3n.exe.log, ASCII 7->17 dropped 27 Injects a PE file into a foreign processes 7->27 11 Cotizaci#U00f3n.exe 2 7->11         started        13 Cotizaci#U00f3n.exe 7->13         started        signatures5 process6 process7 15 dw20.exe 22 6 11->15         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 23:45:56 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=patyjn5dngmienmeyslhzyr4jd3g7cqhcz2v7c2lvdw4zj4tugcq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0afff32555fbbdc301d9ffc446e9bebe445d3b186a80bcdbf54342c61e4b4a4d
AgentTesla
17b671d207ca3e6334ddcae8ce17f1317ccaf35e992fed85724313ee1919f519
AgentTesla
3d28762fd17d3315647ac901942b234cbacca781014965398a2079ccc6766337
AgentTesla
5b48475bbc32e2dbd6ebfb746071c6192e57dfdfcfc0cfb1ae9f381663728537
AgentTesla
a0062b106277324b51718baac12082f12f735f370173fa3073abf70b86b016be
AgentTesla
c82132cbb99629877f81482148e3667c3c64b376d6c7486475dc25dd25a64b9e
AgentTesla
cc87cc3cff16721cb3f7e6be1e5be62bcdacafd1fa70ec879c6a9c12a9b438bb
AgentTesla
dfa5e1f893c313deda7e7ea47512b756a21bba962e07cb21248b9abbdaadf3a4
AgentTesla
f4468ef3eb4ae6445b097b0200d918ae0e1bba94b8c4c613031e2aab32c9f083
AgentTesla
f924ed04e2ce70872e8e341379288a15579ade521df2e4d248054fe2d9357ee2
AgentTesla
+ 938 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201010-sabd7vke6a/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
ServiceHost packer
Unpacked files
SH256 hash:
782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185
MD5 hash:
2a5b1193eb4cbda768e150c94e666195
SHA1 hash:
e089cfbf00e49c93b494a05b682bf64bbb9273e6
Link:
https://www.unpac.me/results/cad09eed-d912-41b9-8ba6-4253232c582c/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/cad09eed-d912-41b9-8ba6-4253232c582c/
SH256 hash:
ce8f143f9766a755e2faf7fb1bd1caa25ebab7a7c8931d152664cfc624809cfd
MD5 hash:
da70345ccd7188053feb0f72aa6c9652
SHA1 hash:
356751b9944ad1825c60a9b7c67b2a250c710a44
Link:
https://www.unpac.me/results/cad09eed-d912-41b9-8ba6-4253232c582c/
SH256 hash:
795a69eb058fa2386f132204b6c6126288ea67290bf90f73fffd3ebf327d4ff9
MD5 hash:
8f035533dc582c2a306063d44d8669a7
SHA1 hash:
49a9d0e0a14a06d48788237b5e90d85d5dbfc6cf
Link:
https://www.unpac.me/results/cad09eed-d912-41b9-8ba6-4253232c582c/
SH256 hash:
4950fe268d89943ec2c678683c8ec15c7290cbfca58416fe41705136f95c7e55
MD5 hash:
a62c7f134bf7bc1bbf80412f058a3de6
SHA1 hash:
56714bca51d08a4d42c903c5bbc1b274b5b5ba45
Link:
https://www.unpac.me/results/cad09eed-d912-41b9-8ba6-4253232c582c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635

AgentTesla

Executable exe 782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185

(this sample)

  
Dropped by
MD5 2e350655203f90e24d766e77a030c10c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/69702/
  
Dropped by
SHA256 7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635

Comments