MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510
SHA3-384 hash: 310db1364c09c7e11460ace8e557b4fafafa76e4f4e2f27f732d23b0a573cb9e4293bf50c3ac32886b7247c4dc5af977
SHA1 hash: 44d776b496ba926e48d5b5def8eeaaab6d64feb8
MD5 hash: 8f12c0c6c1854dae382473bfe77019f7
humanhash: helium-hamper-burger-may
File name:PO#68732.png.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'892'288 bytes
First seen:2020-07-20 08:55:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:g8TKmQCz27pu7I9hJdC8rC9IhZrA8DkPcnYs2pvARrYknQgQiZXs9Rs/g:FLTKIoFOP
Threatray 11'293 similar samples on MalwareBazaar
TLSH 2DD56C3234C3AC99C9AA4DB8D434A9C4AE783D4B3724861CB4DB234C5E5715BFB2747A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.arcohosting.com.br
Sending IP: 162.221.185.34
From: Laurence Gex <marcelopaiva@granisa.com.br>
Subject: Order Details
Attachment: New Order.z (contains "PO#68732.png.exe")

AgentTesla SMTP exfil server:
mail.kaysarplastik.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28838/
Result
Threat name:
AgentTesla MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/391128
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247913 Sample: PO#68732.png.exe Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected MassLogger RAT 2->49 51 Yara detected AgentTesla 2->51 53 6 other signatures 2->53 8 PO#68732.png.exe 5 2->8         started        11 pcalua.exe 1 2->11         started        13 pcalua.exe 1 1 2->13         started        process3 file4 39 C:\Users\user\AppData\Roaming\...\foxy.exe, PE32 8->39 dropped 41 C:\Users\user\AppData\...\InstallUtil.exe, PE32 8->41 dropped 43 C:\Users\user\...\foxy.exe:Zone.Identifier, ASCII 8->43 dropped 45 C:\Users\user\...\PO#68732.png.exe.log, ASCII 8->45 dropped 15 foxy.exe 8->15         started        18 cmd.exe 1 8->18         started        20 foxy.exe 1 11->20         started        process5 signatures6 61 Writes to foreign memory regions 15->61 63 Allocates memory in foreign processes 15->63 65 Injects a PE file into a foreign processes 15->65 22 InstallUtil.exe 4 15->22         started        25 reg.exe 1 1 18->25         started        28 conhost.exe 18->28         started        67 Multi AV Scanner detection for dropped file 20->67 69 Machine Learning detection for dropped file 20->69 process7 file8 35 C:\Users\user\AppData\Local\...\origiiiy.exe, PE32 22->35 dropped 37 C:\Users\user\AppData\...\MassLoggerBin.exe, PE32 22->37 dropped 30 origiiiy.exe 22->30         started        33 MassLoggerBin.exe 22->33         started        55 Creates an autostart registry key pointing to binary in C:\Windows 25->55 signatures9 process10 signatures11 57 Antivirus detection for dropped file 30->57 59 Machine Learning detection for dropped file 30->59
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:57:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgmkyptijkfynk6hqtwpxtskeosuczxphienjf5afcg4mz6g6uia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
12c7ff58c14c67fa84752c1b136860c7c621ccf8cd947183f6b1c918b4c8c737
AgentTesla
15ac6b1a7fdb92b545dae44b1a88d6328629944771bdce75002637cdbf299027
AgentTesla
420541ff7ab7f97d2110f9c2f2488087c0d2f9e577fa5e55c73eebf4f5416bbc
AgentTesla
540a1ab8a63b1b07ea3d80939868a94dafb79f6e2fc37a8a2cc22ded21c60deb
AgentTesla
577f1aaf7014272adaeffea243272a164641c90553f5d87e4dee03037b2b8a82
AgentTesla
63b7d1315ae6db5a6f0c66fd1e8ade94a83a9bda0eb3864734e511c087430d7c
AgentTesla
7029f74bfaf5637a25dad61b7a7462141833886ac9637790d0fdaf7e72d84a3f
AgentTesla
cae8cc4a40faf9c3474f86baf427e7eb1c63c4d75afec8a99da5f616752ffbdd
AgentTesla
e91593299dba4d7f9362c8d64e701413af0384f0f7ecca356ab138497f3a8e4d
AgentTesla
fbb99e9576db212b02fd60fc214d3cd9faa9f2f019103ea8dc1aec8424bd4ba7
AgentTesla
+ 11'283 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
ransomware spyware keylogger trojan stealer family:agenttesla family:masslogger persistence
Link:
https://tria.ge/reports/200720-dxkfzxeysa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetThreadContext
Looks up external IP address via web service
Adds Run key to start application
Reads data files stored by FTP clients
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
MassLogger log file
AgentTesla
MassLogger
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z bf6acf9276de65e04d6317c7c651a9b2ec3aa60528421fbb585ab48bfda428b2

AgentTesla

Executable exe 7998ac3e684a8b86abc784ecfbce4a23a54166ef3a08d497a0288dc667c6f510

(this sample)

  
Dropped by
MD5 250ebbe12051c356ba4802f4bb93a42a
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/28838/
  
Dropped by
SHA256 bf6acf9276de65e04d6317c7c651a9b2ec3aa60528421fbb585ab48bfda428b2

Comments