MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8
SHA3-384 hash: fa8cd1adc58a26c01d89beb7a80be9ae49d1870e3d27df3371f3e423b4c89eb60420a536624b93aa72089a8ae9d4d16a
SHA1 hash: 4ad73a96c9c4b03e86e5a62e49db2bb2c8eea97b
MD5 hash: 597b73672275a514feefc5e091d99fff
humanhash: quiet-autumn-connecticut-sixteen
File name:Picture1.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'672 bytes
First seen:2020-05-01 11:24:33 UTC
Last seen:2020-05-01 11:56:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:asYEQDzYAaNvSX44gc5aAsDuaxo/gVofmlUeEu934tOqa2/TEP8I32iu6P39llOE:aLUAaNn39Dua5Ua92HTq8ImiuA9bs
Threatray 27 similar samples on MalwareBazaar
TLSH 03940293EF99C231DEAC1B7715A1130FCBB857E62152E75D4A982D890AF3B135120FCA
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.goberks.com
Sending IP: 45.95.168.139
From: Goberks Inc<info@goberks.com>
Subject: Property Sale
Attachment: Picture1.img (contains "Picture1.exe")

AgentTesla SMTP exfil server:
altaradiproperties.com:587

AgentTesla SMTP exfil email address:
rashid@altaradiproperties.com

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48211.31002.20885.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 03:43:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 30 (86.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhx7f4fuf2knlk3v4lfcpxjugy4uy3g4awogqgflgd2rg3og67ua._file
Verdict:
malicious
Similar samples:
0af44b9553823391f942810e491b2160386c70982d0ee3e5ab745ae161f7572d
AgentTesla
1dc7b9bc7fc4e17e45e76dfb99d0106802a503fcadbe1669a0fff3499a55eade
AgentTesla
274402fb25f2eef022a8c983908731a36aeddfe2f547057ea6c2e172a8523891
AgentTesla
689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1
AgentTesla
7af2440f0716f18f1d20faee99d68c25bc6e4a3eff067e759d2167aa5211221c
AgentTesla
a46a22affb92f4a76e9a0356c13fd5a8468c43af1b5f3e23d563fcb17331b69b
AgentTesla
c599667585688c32aa84ecbdad1a01e93e4a92beeab76c48f1f415234ce26b6c
AgentTesla
f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be
AgentTesla
f9eb36080d1ab8f016ff0f132add3bd220f01fe6220c9ce3ef554e98318bd33a
AgentTesla
fcdc7b634a27a20fb619cc83b34c74ed0cc850f05fecbf3164ab55413d3e988b
AgentTesla
+ 17 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 4352b9590b958c7fcee31f8788bacd2bf5b4147ae0ef78ea38d2a6be34439a80

AgentTesla

Executable exe 81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8

(this sample)

  
Dropped by
MD5 4a5c048ca89db1e62d83730040d057c7
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 4352b9590b958c7fcee31f8788bacd2bf5b4147ae0ef78ea38d2a6be34439a80

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments