MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae
SHA3-384 hash: 6d44edc634b2c74174bd4c4676b8c5d49c421bd600a631bdff4d4a85b5f3537d920b2ca14d64a30506fae88cf238155c
SHA1 hash: 503296788f68de995e10939079b59b02249100d7
MD5 hash: ab95549310dfb3264f43a3a6106fdf9a
humanhash: alanine-crazy-vermont-magnesium
File name:po_00884613102020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'097'728 bytes
First seen:2020-10-14 16:20:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:lg7dUiqWCdHeCKDWDTgNPjPfdY0B1wNWM33hpCM/xmJDHeWl7eqYW:lg7dfqNHergm7Cy1UKM/xsreT
Threatray 591 similar samples on MalwareBazaar
TLSH 9B35C83DADD5223786BBD6B6C9F515CBFA1179433126AC0E50D703860A03BABBDC251E
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Eric Gaccia <sales1@lamtecmexico.com>
Reply-To: ericgaccia@gmail.com
Subject: RE: Purchase Order 14-10-2020 lamtecmexico industry Co., Ltd
Attachment: po_00884613102020.PDF.gz (contains "po_00884613102020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/70933/
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.37731.11049.12992.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Unauthorized injection to a recently created process
Launching a process
Creating a file
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/491458
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Creates an undocumented autostart registry key
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 16:22:08 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7lbhonsoi47rpjkvkrtrvvo6nsjre567oub44dvvh7xfx4of2xa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
masslogger
Create hunting rule
Similar samples:
1e2ced0bf97c8caa6021784418f2edba1d0e618034fa15d83a0e8896e0936993
AgentTesla
2d9c1413a894e79ddcba0ce405e72fc4be4dae2bb7f9c7931c7d618c5a0c7a56
AgentTesla
39738c9fd5866fa8f6eb0473bb8bf03766e4fff79875f184823269e4fedb50c4
AgentTesla
5e082ed595236d19176b95e02863e7726e36b98a782ce6f8b893667b90b878bb
AgentTesla
6d9a45dbc2e4cb3cbcd745e44efa13c3c895c202bf9367f572d1d94d141cc81f
AgentTesla
79402b00f9e23e5dbb45fc15a079b9308a0a890c7955d0e71e5d5489d9cdaca5
AgentTesla
84d7608b2a41a2f43d6e00e81f09d15dd41bf32f2a9bdfae7204387efb1326df
AgentTesla
aa90926f50f27f99ae4c0001883be71b64dd0bb2f818cb39481f147f52a4658e
AgentTesla
dfa5e1f893c313deda7e7ea47512b756a21bba962e07cb21248b9abbdaadf3a4
AgentTesla
e63d9fff34fc1c54b4e9bcb779e8101ca5e65f84d84e153c0788dec7d8ee5d42
AgentTesla
+ 581 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/201014-865tlp18yj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae
MD5 hash:
ab95549310dfb3264f43a3a6106fdf9a
SHA1 hash:
503296788f68de995e10939079b59b02249100d7
Link:
https://www.unpac.me/results/72f0c01e-4daa-4c8b-b541-26c9d1963fd5/
SH256 hash:
ae1fff731e42bfadfecbd854942e74ceda05905bb0b75bb1a0f18d31c660406b
MD5 hash:
c04200c3999316ed732355bd6688173a
SHA1 hash:
179f09c009378a582ba0265c10bf417391c81533
Link:
https://www.unpac.me/results/72f0c01e-4daa-4c8b-b541-26c9d1963fd5/
SH256 hash:
165b6353a27653c087637f372f70713e4e0af658e87f03ba0703d8b975525243
MD5 hash:
112730ad698bcb62cfb8c64c4862640a
SHA1 hash:
6b42b1f3f372785c40b4f80c35d6aa2e0d012429
Link:
https://www.unpac.me/results/72f0c01e-4daa-4c8b-b541-26c9d1963fd5/
SH256 hash:
fb39e15f5fec0ea7880dc7dcb8cc61a65d5e58565f62d25fb8dce191391323c0
MD5 hash:
cbd3c74979ec4a55cf6ee89e2108a13d
SHA1 hash:
d34a0cddf6319a56ba7a7102a27299704d1af541
Link:
https://www.unpac.me/results/72f0c01e-4daa-4c8b-b541-26c9d1963fd5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 097140a6ed1f32b6c3ca460ed2396776a415aaa8fa2440adc8c2c58476843ef7

AgentTesla

Executable exe 7fd613b9b27239f8bd2aaaa338d6aef3649893befba81e7075a9ff72df8e2eae

(this sample)

  
Dropped by
MD5 af8a9cebfac256b23a5084553fcb0635
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 097140a6ed1f32b6c3ca460ed2396776a415aaa8fa2440adc8c2c58476843ef7
Cape
Cape
https://www.capesandbox.com/analysis/70933/

Comments