MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d0588c83332fe92ebabc72cc32b6d3ddc7d13e66e369d91285a78fdf625621c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d0588c83332fe92ebabc72cc32b6d3ddc7d13e66e369d91285a78fdf625621c
SHA3-384 hash: 1def9e3c22e2446a7640899894f2a0dc04b004f449ec390e614fc3e996373052babab63eb65bacd3390b5de4beeec467
SHA1 hash: ce494328b36375c6cc8d3a02154835368d023164
MD5 hash: c049d39cd8ff83a86990b12f94d4d3fa
humanhash: golf-beer-ack-harry
File name:7d0588c83332fe92ebabc72cc32b6d3ddc7d13e66e369d91285a78fdf625621c.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'500'160 bytes
First seen:2020-04-27 08:59:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:qAHnh+eWsN3skA4RV1Hom2KXMmHaN6UADRuTPZGql7rF2ZIzxInvBCDhZc5:9h+ZkldoPK8YaIBETPt9IIzxaBQq
Threatray 11'046 similar samples on MalwareBazaar
TLSH 8365DF0273D2C032FFAA92739B6AF2455ABD79650133852F13981DB9BDB01B1277D263
Reporter JoulK
Tags:AgentTesla


Avatar
Jouliok
Exfil: ftp.lookmegarment.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.AutoIT-3.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 09:10:30 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pucyrsbtgl7jf25ly4wmgk3nhxoh2e7gny3j3ejilj4p35rfmioa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
055dac93b366fb905ba0bc329170747973235cfffb8954783bc6977b2cca8c60
AgentTesla
0ed4038207551d5ecc8f59b059594644424649d026b8c63745dfff14b68749d9
AgentTesla
543f935852d249ad9f5e15796a366bec0c560a6fb4d0980525a030029f31a220
AgentTesla
73ee8521291eac3ffd5503fcde6aa833624e15904760da85dd6141f8986da4a3
AgentTesla
9c855a81fc64176ff278af29291f27501b413b8d5ead754f13f536355af4e1a3
AgentTesla
af7df7cf389f5be27e5dfaac769693d2ed4f6406b0a9f8dfdc64aaeb469f1d17
AgentTesla
bce67ac809305c762570f248c3edf7551e37c11b262504035e1e56cf1c30f70b
AgentTesla
d9055a52862d279916cedbadecb44061ea5674883e9f63cfe98e6b6adbd0b249
AgentTesla
e149a102d8d46f836240231143538c91f2d4bf6f4dc37fbd3cc20d0813ddcdb8
AgentTesla
e59cd07929dcd890599b9ef376fb022a9b0408cd3547a6ebcbffca87932dd631
AgentTesla
+ 11'036 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 7d0588c83332fe92ebabc72cc32b6d3ddc7d13e66e369d91285a78fdf625621c

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::CopySid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::GetAce
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoCreateInstanceEx
ole32.dll::CoInitializeSecurity
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::mciSendStringW
WINMM.dll::timeGetTime
WINMM.dll::waveOutSetVolume
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetAclInformation
ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateHardLinkW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetAddConnection2W
MPR.dll::WNetUseConnectionW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BlockInput
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::FindWindowW

Comments