MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92f6d1e82205b64904076dbcb9909bc3ff06cd4c58c87518470eefdd8b4df084. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	92f6d1e82205b64904076dbcb9909bc3ff06cd4c58c87518470eefdd8b4df084
SHA3-384 hash:	b7ca826c719fad9cbec3cc5b89c778b904eedf97fd4f4aa553fd11de5e586d82aa626921de8b6466a6f17b00afa27aa8
SHA1 hash:	bc12640a4387d50155642bf773337620b2112ae5
MD5 hash:	531490e562cff3b98b57d65c7ef93801
humanhash:	maryland-oklahoma-maryland-sixteen
File name:	REFERENCE FOR QUOTATION AYBF001 PDF.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	708'608 bytes
First seen:	2020-06-08 05:37:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:pEYNg3bJeUp+kOuz3bGIrPGiL4R4iHOhF8/ol8Zh:eY+bJ9muTbGsPGiSoSG
Threatray	10'592 similar samples on MalwareBazaar
TLSH	57E4D8E1B340949DE86769B9483ADDB32023AE6E9D2D510D2496BF1E7E7335700378CB
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: zcs-mta01.frontiir.net
Sending IP: 59.153.89.50
From: Harun Ozbek <soe.aung2@frontiir.net>
Subject: PR259 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd++
Attachment: REFERENCE FOR QUOTATION AYBF001 PDF.IMG (contains "REFERENCE FOR QUOTATION AYBF001 PDF.exe")

AgentTesla SMTP exfil server:
smtp.logscome.xyz:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Backdoor.NanoCore

Status:

Malicious

First seen:

2020-06-08 05:39:08 UTC

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sl3nd2bcaw3esbahnw6ltee3yp7qntkmldehkgchb3x53c2n6cca._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

295fcf9d436999a321ff1c4efc6a0191e1efe3d68becd3d9d9965a64f540b0f0

AgentTesla

5761ed082c15df8c9fb6fadcff317a227008848db681d92ae959fe481e05e212

AgentTesla

62005a4721dc55f0752df55ca79bd85ccb46ba28a34d10d8f29880e087b69896

AgentTesla

6edf56bf042ac4f2cf12f3dcdd5704e71ddeee943463706513ba51123209bc6f

AgentTesla

a5bc29d5e6f55ba05f61fff45175d9864ee0b311ad45baf0cfd65c74666da14c

AgentTesla

a85526e4a0f78afd83f57f2d084c0bd4b82846a06a0aef80c473905561dcfb60

AgentTesla

b1135688496020eb3e075121b22fb9c726c6021068ce415be82d8e48540dc563

AgentTesla

b283242e8ae83c1b2136090df9d70d06e328ee7116186667ed766d87f468da93

AgentTesla

f242ad8f253e4e481529cffa7b3d697683649ba31b8c8500f2d24d2bf591e553

AgentTesla

+ 10'582 additional samples on MalwareBazaar

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar