MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a89bde0a6c3c23a3eb3b6e44f0ea164a30f8fe80f07cd5e016006dae718acc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a89bde0a6c3c23a3eb3b6e44f0ea164a30f8fe80f07cd5e016006dae718acc2
SHA3-384 hash: e7ef18431fbd091b71bf3453a3e47b6b481adb5b9c7256731dcc8f720814f144966f899ac7d395b85b5400f5a78bb1a9
SHA1 hash: a06d643dc7d86e547c145bec99c21aa07b0dd797
MD5 hash: 3c06c6013a33acdb0304c5f82ae04202
humanhash: diet-hawaii-friend-connecticut
File name:Payment Breakdown689.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:453'913 bytes
First seen:2020-04-27 23:11:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7eae418c7423834ffc3d79b4300bd6fb (51 x GuLoader, 16 x RemcosRAT, 15 x AgentTesla)
ssdeep 12288:wHQkvWWegrLwgYB38j+2b4IWIdKYOkvCKEmH:QQk1NKBI+eJ0Ud
Threatray 10'857 similar samples on MalwareBazaar
TLSH 0FA413A2E1E4C877D8A360B8743FDE2235BBED1E60A43D436751BA0576B3683925D703
Reporter c_APT_ure
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Makoob-7546093-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EKCH.14211.11984.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Makoob
Create hunting rule
Status:
Malicious
First seen:
2020-01-14 14:49:03 UTC
File Type:
PE (Exe)
Extracted files:
71
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
1dca04a092036da431753ed714b8e11bbd6ed1db8c9b3755d05bb8c61fcfc805
AgentTesla
2474586827d8955e084438012fb1b977249fb8754137bd1ac0071dbaa6ba22aa
AgentTesla
2fcc3c49cbacd359f308ab59cbafdec24f95d4b638bf9c2fd5dd466379dac3aa
AgentTesla
38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba
AgentTesla
69743cf570a9635bebdf3c89b4ad7c6824efac3c2c3ee33577177fb7954848a6
AgentTesla
76aeceb07ade4e0dca6cf046b682ae5909f578b725da30d10a46c6fb58cc3f33
AgentTesla
7ab3cbcd225fda209a34c512ef956131c4430d84b7836b925739701686a24630
AgentTesla
dafdcd9e9b75c4d7187fcfb384788bf5925a1a3426eb7e6d3cc2147b5e9bdc66
AgentTesla
e6f2d277d61fd27d2a6452619111c272047ff478247251c9ec5651f5f67e1519
AgentTesla
f23a280b7303eaf61fc3f6650dd4f879d80250d2db7051ed569f5270dbc4c22e
AgentTesla
+ 10'847 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments