MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 878e1a1b65cc05eb728bf4ce85b7ad87576bbc9c8465d1348c71cef4e8c098f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 878e1a1b65cc05eb728bf4ce85b7ad87576bbc9c8465d1348c71cef4e8c098f2
SHA3-384 hash: d56293807cf6d7c5c21085ce6469e94f82ea0c9ebec21411aa6650c4df4588a319f1cad16fb05bd214a6f6f21310c189
SHA1 hash: 8eca265739fce957205846992fee1abac60b4d56
MD5 hash: 421f7936cf9984792c119c3602f2ac17
humanhash: freddie-tennessee-blue-maryland
File name:New_Order08042020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:885'760 bytes
First seen:2020-08-04 13:13:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:IGEyF96jC2B4+B7JZwaeXQnINKbRb3KoR:z96e2mkJZwaeXCI81r
Threatray 737 similar samples on MalwareBazaar
TLSH AB159C4C9585C36FC5F482F9D8AF4AF54BB22CB2E4E5BA0721347C8739B6254F611B22
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: oliphaunt.gmikenma.com
Sending IP: 199.58.179.120
From: Sales <cas@industralmail.com>
Reply-To: Sales <mmurhaf23@gmail.om>
Subject: Re: New Order
Attachment: New_Order08042020.zip (contains "New_Order08042020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Sending a UDP request
Running batch commands
Unauthorized injection to a system process
Result
Threat name:
MassLogger RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/409422
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected MassLogger RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256988 Sample: New_Order08042020.exe Startdate: 04/08/2020 Architecture: WINDOWS Score: 76 69 Yara detected MassLogger RAT 2->69 71 Machine Learning detection for sample 2->71 73 Machine Learning detection for dropped file 2->73 75 2 other signatures 2->75 12 New_Order08042020.exe 3 2->12         started        process3 file4 61 C:\Users\user\AppData\Roaming\SDTFYGJHK.exe, PE32 12->61 dropped 63 C:\Users\...\SDTFYGJHK.exe:Zone.Identifier, ASCII 12->63 dropped 81 Maps a DLL or memory area into another process 12->81 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->83 16 RegAsm.exe 3 12->16         started        19 New_Order08042020.exe 12->19         started        signatures5 process6 signatures7 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 16->65 21 cmd.exe 1 16->21         started        67 Maps a DLL or memory area into another process 19->67 23 New_Order08042020.exe 19->23         started        26 RegAsm.exe 2 19->26         started        28 RegAsm.exe 19->28         started        process8 signatures9 30 conhost.exe 21->30         started        32 powershell.exe 19 21->32         started        79 Maps a DLL or memory area into another process 23->79 34 cmd.exe 1 26->34         started        process10 process11 36 New_Order08042020.exe 30->36         started        39 RegAsm.exe 30->39         started        41 powershell.exe 18 34->41         started        43 conhost.exe 34->43         started        signatures12 77 Maps a DLL or memory area into another process 36->77 45 RegAsm.exe 36->45         started        47 RegAsm.exe 36->47         started        49 cmd.exe 39->49         started        process13 process14 51 cmd.exe 45->51         started        53 conhost.exe 49->53         started        55 powershell.exe 49->55         started        process15 57 conhost.exe 51->57         started        59 powershell.exe 51->59         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/878e1a1b65cc05eb728bf4ce85b7ad87576bbc9c8465d1348c71cef4e8c098f2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:15:07 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6hbug3fzqc6w4ul6thiln5nq5lwxpe4qrs5cnemohhpj2gatdza._file
Verdict:
malicious
Similar samples:
4c8728146976e30a09321d1e158aeeb46908c54fa8614ccef7fbc9761956eca4
AgentTesla
7a844a73345acfd4a047d76088829ba790ae67a7d3a3527feecb290c6dbfc3bd
AgentTesla
9753fb15b17d78d8f7793caadf177d71bf6f0a99e490537e768812a835db22fa
AgentTesla
987e0b5d35a989d7eff88f7aed06a643e18d500266871e9e1cb901ed8f3d484a
AgentTesla
a4df7bd8daff5a4723055c7589244e1719c45223f09f42b06a621aad5ee1f2f4
AgentTesla
b99de03440f57a55e0c9a269df9d79ff2214eb859361d217f76fa86579fd82df
AgentTesla
bcd7372fd84fe78e97a72a842df6cab2a5d7a47909a3fd05b13f6f4990de8a7f
AgentTesla
c3678d87151b21e6a29ded035522c1c22950f97787e45b3df2dba52a4e688c97
AgentTesla
cf9aa52cd8829760f779772b7b483ff039100b5d6311c85f969553b6ce66d58b
AgentTesla
f1ce8a3c72d7e45300b38de923c0ad45c466ef17a44bec4aad85a4672690eb22
AgentTesla
+ 727 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer trojan spyware family:agenttesla
Link:
https://tria.ge/reports/200804-bcr8z1fz6e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
AgentTesla Payload
ServiceHost packer
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/878e1a1b65cc05eb728bf4ce85b7ad87576bbc9c8465d1348c71cef4e8c098f2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 226b7b506870441f3a2bfdce077edbbad4334b5bee2e5fffde263078a169f59a

AgentTesla

Executable exe 878e1a1b65cc05eb728bf4ce85b7ad87576bbc9c8465d1348c71cef4e8c098f2

(this sample)

  
Dropped by
MD5 4169436f6d3ee5739476c9201bb64b7f
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/38682/
  
Dropped by
SHA256 226b7b506870441f3a2bfdce077edbbad4334b5bee2e5fffde263078a169f59a

Comments