MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e
SHA3-384 hash:	63456e9c8ac5779070cae481b8035e2ec4b306cd13e513662d6cfaa3ee63c7fec26ecb947ae2ecaf3319446faebcb1da
SHA1 hash:	d34c8e4e58eec044e1106fad16fb629b8d1d2552
MD5 hash:	662b5f5cbcaaa7ead996a4d05feda9f0
humanhash:	social-one-four-alabama
File name:	PO no.0107-320804-1.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	685'568 bytes
First seen:	2020-08-17 06:02:48 UTC
Last seen:	2020-08-17 07:00:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	90971096b3f3ef49ea4900e0dc05049a (10 x FormBook, 9 x AgentTesla, 4 x Loki)
ssdeep	12288:ngftlTxIDJRRtYRNeuawx2+8zVQLlcqPTxUHYY3UmNUStT4SB8OpmjCU:ng1JxIwP5YxaZ0dD6S0OpkCU
Threatray	1'911 similar samples on MalwareBazaar
TLSH	C2E47C32B1E24437D173DA7C5C3B6367982ABD132B289B466BE07D488F3965136272C7
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing unidentified malware:

HELO: squadraperu.com
Sending IP: 23.106.223.168
From: Larry Berkemeier <margaravega@squadraperu.com>
Subject: URGENT REQUEST FOR QUOTE// Ref: PO no. 0107-3/20/804-1
Attachment: PO no.0107-320804-1.arj (contains "PO no.0107-320804-1.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Phoenix

Link:

https://www.capesandbox.com/analysis/46617/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Connection attempt

Sending a UDP request

Result

Threat name:

404Keylogger AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/432505

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected 404Keylogger

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-08-16 23:57:24 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ptxtco5ok6ntonisme4sm3gtiis7y4pcuofyhllong5hao3r3bpa._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

AgentTesla

121cba7566201217f8725044bc4e51283b873305c5e84b9e1623313cefa5fe4b

AgentTesla

1b891a31aa508effd78b280b17b15c26272802119470fe5d80de04967a924e53

AgentTesla

482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10

AgentTesla

65a226dbf2cb9d30ad397117199260d3b8989e99c01de03a0d4f8eb0622794fc

AgentTesla

8243c8a72e7a2021b4d956f5dafc19ded0162e9eb99f158f8da83660ea9368b5

AgentTesla

8f746ab02591cecc45226d28bf483dff6616f697c1d79f8d1daddd5e8ba1d764

AgentTesla

a2a9054cc0ce0c7c53a7fbf11b1ea81e80a3e4d6ccff09e731281807c17791fc

AgentTesla

b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87

AgentTesla

eacb842bfb2638dad0dfc194ecf323a019780a3ab3be7f2f21e2a0d5726156f2

AgentTesla

+ 1'901 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

upx spyware

Link:

https://tria.ge/reports/200817-b9z8j624m2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184