MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e4719fb11286b8b8db49cf1abdd864ca1a49666f88b1ff9b1d7953415d78650. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e4719fb11286b8b8db49cf1abdd864ca1a49666f88b1ff9b1d7953415d78650
SHA3-384 hash: 003bcd102f19dc69a55fadf0b3abae28727929a18aea229fc843b542b16f9a27b9eb0a3c1ea2ea353169ffbb35399fd1
SHA1 hash: 120d280aa5a945a21816c99a51aa0bc9d5b301b8
MD5 hash: 86fb88f299a0a8be9302927da3ae8ba2
humanhash: alanine-uranus-hydrogen-stairway
File name:PURCHASE ORDER EX-6531_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'624 bytes
First seen:2020-05-13 10:02:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:eeK4fpnn0N9Onh2zFx+WMTs56uEL7z0IIs6DilpYwuEOSjJwUWiUHbWJFs:eNSpnw9zf+WMTOev0Ia+lpYw2Sdrgyvs
Threatray 11'337 similar samples on MalwareBazaar
TLSH 689412AD62CDA53FD76E42F89490025D53F4816639B2E7CD9CD3D0C7A6A23C14C23A6B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hosting.comnet.net.id
Sending IP: 202.150.128.130
From: Muhammad Baber <agency@darvishi.com>
Subject: PURCHASE ORDER EX-6531
Attachment: PURCHASE ORDER EX-6531_pdf.gz (contains "PURCHASE ORDER EX-6531_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR.25133.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 10:38:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pzdrt6yrfbvyxdnutty2xxmgjsq2jftg7cfr76nr26ktifoxqzia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
093313195ab55c462e616e41f5b20e0f876d69e1941d34cd05302c82d8eb20e7
AgentTesla
0a01b1216756a73d1032ee9841bd4fee822a87d0f5cba6c2213bb0032a4b321c
AgentTesla
2919867ab52378d55e7d91b3b18c30b79c8527621aa9e2c2fe71d0b89dbc404a
AgentTesla
4c247b8c2dd30ae28d1bb49828ae301e3f21e39d207258aa20f9e6ae3e56cc6d
AgentTesla
51dcfa3c93b66cc14212370d872b939cf17ddd1c45bdca4cd69ed1bfaa90e800
AgentTesla
76333652b5c82499dde362e8892ff2316a455ee5118f6127d6462ec3654cd544
AgentTesla
accddeb954844341b87c006344f21c50757cd228d2f071d39e8707209b1a49f9
AgentTesla
b69b060cf9fec8a233ad129cc75eaaa1c439ba29dd5256a90df085ff34c47ee9
AgentTesla
c706f368dbef31f72b1014d16a23f3f69abdbad6f62571e6325930c549afda2c
AgentTesla
fbc70395ea55477b8827145c12f85133565b1be20e31f71327ea17d2706127be
AgentTesla
+ 11'327 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-47rpms6s46/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c0313b5eeac1530022502db9c57434f74301cbdf7e8211d7d204884ff84cc00b

AgentTesla

Executable exe 7e4719fb11286b8b8db49cf1abdd864ca1a49666f88b1ff9b1d7953415d78650

(this sample)

  
Dropped by
MD5 ef1ab4d6008929771f84f04c9b00969c
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 c0313b5eeac1530022502db9c57434f74301cbdf7e8211d7d204884ff84cc00b

Comments