MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c
SHA3-384 hash: fb7d5c14dd3095c69c3d846fae08d675b8eecd12859793a441d2aa9a179e24b8ae02b33962a93518aa1138b71e746962
SHA1 hash: c59942cdcd9150efcd5de3bcd27ff3ebd797c34c
MD5 hash: 8ca7a1b98393f52dba795ea2cf181eba
humanhash: ink-delaware-beer-bluebird
File name:Purchase Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:778'240 bytes
First seen:2020-06-30 12:14:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:gqaPgAn1huRsAjnivMKido8VTjfGT4gnhGvVm:RaoAn1ofjnev0xlycgnhGdm
Threatray 10'756 similar samples on MalwareBazaar
TLSH F9F4F03261688357F7E50A7968B156500FB17F6BA158CA3B9EE074CAF5B3BC0CB01726
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail030.nameserver.sk
Sending IP: 195.181.249.14
From: Sam Karow <samuel@glx.sk>
Subject: Revised - PO QTY
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
mail.titanworkinharders.com:587

AgentTesla SMTP exfil email address:
ogor@titanworkinharders.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17121/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 09:53:25 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2ndhl4alsdloff2fvsmuicpommmqslgb2mk3v2olcjrrmrfb4oa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
052148f226d2b1e51ca7318eacda6906765138d2e28b290558a2b7003e9f6634
AgentTesla
2645e6f05ce2c3ebfb5e928cfe3216d6da26dbe57c63113d70b8447b3fd21b5e
AgentTesla
29c9b2df968cf06a228499ea0ff480ce413431632194333ce7b7d3083c980554
AgentTesla
4c72144a1bf6af1702d13a66880820fb987125f63216a40e627ad963b85eeb39
AgentTesla
7b888494d9279f87b3b2a69e11fa5a68efa06bc86522d02764382da220396861
AgentTesla
917cb3f1f38601270535643b8f26581f6a19f8e5eeaaf17f84324d186ea95cc4
AgentTesla
9c3e77fb2e750cac9a2557d9b1a0bb202094e0a11605196c6786f3594fcd15d0
AgentTesla
ac817954a4511d2a0ffca7832b48d137db1b299d7ff055709eda1d12460e81c0
AgentTesla
addb2e3a02342b031f2313bfc910927b94904faed320fc4b52e4b8fec77d622b
AgentTesla
f0f3f94877ac55a99e46669fa232ef88e1646b019864a27229be3ab23a17bf85
AgentTesla
+ 10'746 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/200630-t33gt4x9qj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run entry to start application
Reads user/profile data of web browsers
Reads user/profile data of local email clients
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

fd56b14b02ce9623e0348acd87c33581

AgentTesla

Executable exe 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c

(this sample)

  
Dropped by
MD5 fd56b14b02ce9623e0348acd87c33581
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17121/

Comments