MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 5 Comments

SHA256 hash: 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c
SHA3-384 hash: fb7d5c14dd3095c69c3d846fae08d675b8eecd12859793a441d2aa9a179e24b8ae02b33962a93518aa1138b71e746962
SHA1 hash: c59942cdcd9150efcd5de3bcd27ff3ebd797c34c
MD5 hash: 8ca7a1b98393f52dba795ea2cf181eba
humanhash: ink-delaware-beer-bluebird
File name:Purchase Order.exe
Download: download sample
Signature AgentTesla
File size:778'240 bytes
First seen:2020-06-30 12:14:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:gqaPgAn1huRsAjnivMKido8VTjfGT4gnhGvVm:RaoAn1ofjnev0xlycgnhGdm
TLSH F9F4F03261688357F7E50A7968B156500FB17F6BA158CA3B9EE074CAF5B3BC0CB01726
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: mail030.nameserver.sk
Sending IP: 195.181.249.14
From: Sam Karow <samuel@glx.sk>
Subject: Revised - PO QTY
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
mail.titanworkinharders.com:587

AgentTesla SMTP exfil email address:
ogor@titanworkinharders.com

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 25
Origin country FR FR
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17121/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Agensla
First seen:2020-06-30 10:01:12 UTC
AV detection:20 of 31 (64.52%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   7/10
Malware Family:n/a
Link: https://tria.ge/reports/200630-t33gt4x9qj/
Tags:persistence spyware
VirusTotal:Virustotal results 15.28%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:Warp
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Author:Seth Hardy
Description:Warp Identifying Strings
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

fd56b14b02ce9623e0348acd87c33581

AgentTesla

Executable exe 8e9a33af805c86b714ba2d64ca204f7318c849660e98add74e589318b2250f1c

(this sample)

  
Dropped by
MD5 fd56b14b02ce9623e0348acd87c33581
  
Delivery method
Distributed via e-mail attachment

Comments