MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87b13e8ecfe5abb89f206f65c0e0676a70bb25533f3af9fd336c1075e7abd174. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	87b13e8ecfe5abb89f206f65c0e0676a70bb25533f3af9fd336c1075e7abd174
SHA3-384 hash:	9e40fd0cff74ecf579cbe603bfa67adc2ac9a33b9626ea84eadbcad49961bc39c8e1ae8c4f04e37d9b315987ef5e861f
SHA1 hash:	2bbcc7675d4ddf0ab1b79a705bc67be963241f2e
MD5 hash:	e2921c187ea58f0e8f5d62f83739e3ae
humanhash:	salami-neptune-romeo-stairway
File name:	SHIPPING DOCUMENT PL&BL DRAFT.EXE
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	541'696 bytes
First seen:	2020-12-03 07:11:39 UTC
Last seen:	2020-12-03 09:13:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e16bf585377a2c04ffc8f29a891831dc (5 x AgentTesla, 1 x Formbook)
ssdeep	12288:DC3gUFWNmA/+85/FK5J94p3wubcom2lXsA3:DpG8VQ53qAu7mmX
Threatray	1'628 similar samples on MalwareBazaar
TLSH	D5B4E008B0808035E8B3027749AE5716967DBD210B6769CBB3CC7D5D1B79AD17B31B3A
Reporter	cocaman
Tags:	AgentTesla exe

Intelligence

File Origin

# of uploads :

# of downloads :

108

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/106498/

Detection(s):

SecuriteInfo.com.Trojan.FakeAV.20540.26174.8080.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Result

Gathering data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/554300

Signature

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/87b13e8ecfe5abb89f206f65c0e0676a70bb25533f3af9fd336c1075e7abd174/

Threat name:

Win32.Trojan.EmotetAE

Status:

Malicious

First seen:

2020-12-03 07:12:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=q6yt5dwp4wv3rhzan5s4bydhnjylwjkth45pt7jtnqihlz5l2f2a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

35ed6436ca1de548bf30bcf8c365ed734e06606d606960094c0f5776ee12c48b

AgentTesla

423564a7b9dbcb8a5b81a2b2332287287e359725efe04afa2dc7e43755c0799b

AgentTesla

7aca2c9fc681d73f89b0f2127bbdd5001f7675ec9788e3d5fd5ec7a0405dd49b

AgentTesla

7d69ecaf108320a941b846030a0438843d5cc4ea8067807b7db4b783c1fffa60

AgentTesla

879fabd244225331efd47ce153381e8c2bcf02a9b81b430e346f6395ecc9c666

AgentTesla

89e36f73f667df03dd636f766a9b127c9c0b307fc0ae3149b2d1ff6f34c84b09

AgentTesla

a21e38f8f6be5ca6ad235835b89f774e142683615b5bec677d3cf49fe78c2f16

AgentTesla

ce2c29bbd18352557dd6fb16e294265d66d8d13e6d0586ef8030bbeb28e0cc97

AgentTesla

e12243e5bae35e437f9e88665c52d3b5086cc5dab0eb5c682132a288625b023d

AgentTesla

+ 1'618 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201203-lbv65frm42/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

87b13e8ecfe5abb89f206f65c0e0676a70bb25533f3af9fd336c1075e7abd174

MD5 hash:

e2921c187ea58f0e8f5d62f83739e3ae

SHA1 hash:

2bbcc7675d4ddf0ab1b79a705bc67be963241f2e

Link:

https://www.unpac.me/results/061fc60c-59cb-4140-9b23-827125576c54/

SH256 hash:

50786d52331417e0808ede2f31ecba191a03b968d96902c1a267b88a056fadd0

MD5 hash:

b8c82795a5991deddc393fb5ce142a12

SHA1 hash:

8caf9c4ee7fab41af144277e6242cb1ef503e647

Link:

https://www.unpac.me/results/061fc60c-59cb-4140-9b23-827125576c54/

SH256 hash:

0a02c32566edef458a0be9f4eee45bb91eef6409c34d0852bfe48766bed898ca

MD5 hash:

2d2c3f90894398911104f162131cd609

SHA1 hash:

51966412f590867fad11c5574662ccd249f53eb8

Link:

https://www.unpac.me/results/061fc60c-59cb-4140-9b23-827125576c54/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Cryptor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/87b13e8ecfe5abb89f206f65c0e0676a70bb25533f3af9fd336c1075e7abd174

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.