MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180
SHA3-384 hash: 982e7bebc3b3a58e90eb7f2c4706b7bc945b9ede6fe662a0dadf04ba335f46ca330e53db7ea1c399b592f40de1449f7f
SHA1 hash: 314a40b1275ba660b2ea3917182306b2fbb9d776
MD5 hash: f2be19aa12e2ec74072d0ecc2c4378e4
humanhash: hydrogen-chicken-angel-lithium
File name:Y0RPVRqrZEp13Ov.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'688 bytes
First seen:2020-10-05 11:49:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:BFg+4FP0Job5F5PgN0a9iWlhQYkoGu2/46lsRQrRFUbWhFnJlT4gPSihEWMr4:BFg+UP0JoVLPgms9Q9oDWsRQfesW8
Threatray 330 similar samples on MalwareBazaar
TLSH 26B4CE3116885BABC3BD55F8C861750142F4B6921262EECD3C956CDB34CAF8DB72278E
Reporter abuse_ch
Tags:AgentTesla exe GarantiBBVA geo TUR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.elmasgrafik.com
Sending IP: 185.48.182.122
From: Garanti BBVA Internet <dekont@garantibbva.com.tr>
Reply-To: dekont@garantibbva.com.tr
Subject: BBVA HESAP BİLDİRİMİNİ garanti eder
Attachment: NNqTIvVLR84ND1h.rar (contains "Y0RPVRqrZEp13Ov.exe")

AgentTesla SMTP exfil server:
mail.petekyazilim.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68174/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/481357
Signature
Found malware configuration
Injects a PE file into a foreign processes
May check the online IP address of the machine
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 06:55:02 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=slhbzkx5kraggljs6izbssyfv3vus4bnloznlrxa6sxsgeldcgaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
15814d40339c1e572590b74683dec0fdf2e55e7f565be6e806adfa2e59c4a915
AgentTesla
1c57584d17a78224d13c1535e275fdb9694ea0843393d02a3395213813065b97
AgentTesla
546ca9154ddc425843391ba45da25d60e4c89d85d34dfc5028fb56ed94861bbf
AgentTesla
61ec5f86a1162c5b422c27f58a27e64d15132c6f21e4499ed03b88f84fb02362
AgentTesla
70043ff6d416c9ac20ada0e4b9031e5d55d2733a96eb4ddf3ec327c4b8abd8d2
AgentTesla
745a8ed362468f17a52c1b7f8b128250ce9c7d3949890166259e2e1ac3069e3e
AgentTesla
b27e64df6a3791d23937cdc503aa9314770409a13dab6565b05570381cd71189
AgentTesla
c1dad248279062c4c79245226d28fe8565bad5d652b0dae10ed81b310581e73d
AgentTesla
db2aa0c18078e1b88151524bd9a42092d6ad226867b128bf6b261084bc99698f
AgentTesla
eeba7537e3916a6c6d52340f648f970c4ad8369052fbc235b5ce4e3f166c9aae
AgentTesla
+ 320 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
evasion spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201005-62a42xrcwa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Looks up external IP address via web service
Checks BIOS information in registry
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
AgentTesla
Unpacked files
SH256 hash:
92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180
MD5 hash:
f2be19aa12e2ec74072d0ecc2c4378e4
SHA1 hash:
314a40b1275ba660b2ea3917182306b2fbb9d776
Link:
https://www.unpac.me/results/2ac9d614-1c7d-4154-99e9-4fbec6f5fce6/
SH256 hash:
01dd844990e0c5fdcea0f88712253aa1ef4750316f0734ab7099306170b5ea2a
MD5 hash:
eb593633270aa19162cf64663df9dd6c
SHA1 hash:
2ec57181471ff10abe9a04239ca3ea86ea4252b9
Link:
https://www.unpac.me/results/2ac9d614-1c7d-4154-99e9-4fbec6f5fce6/
SH256 hash:
968a2e873087e3244ce6e8477041acc51365818f7cf42dc65623775354a34f2c
MD5 hash:
04d0be5c8f43960f8411b2b97021fd09
SHA1 hash:
0b062086c9137d33ece1e88b0e9e36f7a949b5f2
Link:
https://www.unpac.me/results/2ac9d614-1c7d-4154-99e9-4fbec6f5fce6/
SH256 hash:
5a967c9ff250e8f0508a012ca6ef8f89cb73b7d83aa4cba67238938ff1755c57
MD5 hash:
4ede4a6d7fae51f8fbd43a96f3f46ae8
SHA1 hash:
3fc4ed4adbf8115eb000c97f75c2d96406137bfd
Link:
https://www.unpac.me/results/2ac9d614-1c7d-4154-99e9-4fbec6f5fce6/
SH256 hash:
030cd2c12f4b0a497d446ae243a432b5ea2ba3cbe0c3f4536fc66029ffa18e42
MD5 hash:
5154267365443d015d6e9ce85b5611d2
SHA1 hash:
a882e79df94c463890e7af93ed73095eaeba5d59
Link:
https://www.unpac.me/results/2ac9d614-1c7d-4154-99e9-4fbec6f5fce6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7a6f40b2b3d360073a1399e73e90f956a45c07b22b2b7e03b1eabc122eece9e3

AgentTesla

Executable exe 92ce1caafd5440632d32f232194b05aeeb49702d5bb2d5c6e0f4af2311631180

(this sample)

  
Dropped by
MD5 dd446c3b3f8c0c1d5077c5df18ecfd4a
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68174/
  
Dropped by
SHA256 7a6f40b2b3d360073a1399e73e90f956a45c07b22b2b7e03b1eabc122eece9e3

Comments