MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8ceba0ecd94e885f32b2e9b68373691b43887e70f6bc903878fdb74551fc919d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 8
| SHA256 hash: | 8ceba0ecd94e885f32b2e9b68373691b43887e70f6bc903878fdb74551fc919d |
|---|---|
| SHA3-384 hash: | 7a1470ee3e7051dbfb0cea029d9cdd0d5b84a47d6fa8df2f76dd5f84c7613fa9c38e2d534dacb20260fc8b31961e8e6b |
| SHA1 hash: | ff6576a6d5d23d775a4960b7ccbb5727044501c9 |
| MD5 hash: | fc9e2df82fdda41c3cbbe5037c9afa51 |
| humanhash: | johnny-high-coffee-summer |
| File name: | Payment Advice_ #MT103_PDF.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 811'008 bytes |
| First seen: | 2020-09-23 06:15:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5d58e68fdbbd7a7d3afa6a6992702bd2 (5 x AgentTesla, 1 x Loki) |
| ssdeep | 12288:GjbBOJuk1EYLwotbltPbjn1gFi7Vik4BKVToDdE0iKKEDB:dn7LPXVui7ViFrRDi+9 |
| Threatray | 752 similar samples on MalwareBazaar |
| TLSH | EE058D26B3B24873D1632A3C9C1BD7749836BE302D28B9466FF5DC489F7964138292D7 |
| Reporter |  sergedroz |
| Tags: | Agent Tesla AgentTesla |
sergedroz
Date: Wed, 23 Sep 2020 07:14:04 +0200From: "HSBC SERVICES LTD." <zaklina.rakic@barajevo.org.rs>
To: undisclosed-recipients:;
Subject: Re: Payment Advice 22/09/2020 - Advice Ref:[GLV924565043] / ACH
credits / Customer Ref:[C27-20190911-142533] / Second Party Ref:[512389801785]
Message-ID: <5e91d820a4569d4d6b3942d524ae277d@barajevo.org.rs>
X-Sender: zaklina.rakic@barajevo.org.rs
User-Agent: Roundcube Webmail/1.3.14
ace compressed
Intelligence
File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Sending a UDP request
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains very large array initializations
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-09-23 06:17:05 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Similar samples:
+ 742 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
upx spyware keylogger trojan stealer family:agenttesla
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Reads data files stored by FTP clients
Reads user/profile data of local email clients
UPX packed file
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.