MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95d78a7f8ede0b8198c9b690fa4ca192a07a80eb67ee3faee1dce5aaa66349e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95d78a7f8ede0b8198c9b690fa4ca192a07a80eb67ee3faee1dce5aaa66349e4
SHA3-384 hash: 2589c269632f27113e6b589277e8da97572be433a69c399e1683f0498068211956c6320848facdf9dacffa69a367f071
SHA1 hash: e00f15e3ca1311dff3a123afb98683c702f80b2f
MD5 hash: 99961f1f84d3596362a689c34c61dac7
humanhash: july-west-oven-bravo
File name:Order_21102020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:618'496 bytes
First seen:2020-10-22 07:41:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:pPl3554jVqt0LR2dTjqjU7EifBEu/WZdqAGEC69A1GKZHNYPzod:FhSV40LA4jU7EipleZdq7ECOA1GUKzod
Threatray 744 similar samples on MalwareBazaar
TLSH 71D4026060A5FB72D7BE87F6211C110983B1149F6BB1E6744DE372EE69A0B05CBD0E63
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: singnet.com.sg
Sending IP: 64.137.176.24
From: Chen Ming<percenna@singnet.com.sg>
Subject: Order Confirmation
Attachment: Order_21102020.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74550/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95d78a7f8ede0b8198c9b690fa4ca192a07a80eb67ee3faee1dce5aaa66349e4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:37:31 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sxlyu74o3yfydggjw2iputfbskqhvahlm7xd7lxb3ts2vjtdjhsa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
02e422396eb123142575e0dcee9f629941c42543ae8839a931e2cc8eefecb9c4
AgentTesla
17a03e39ebafb5fcdd30227fcce2138dc69e353fc1ea131e53dfee3b4190cacc
AgentTesla
5388c70ef1d9bfc414a92c3aa4ea34db6992ee705813b5b4a2b4c28b435cbf6c
AgentTesla
6e7a5741c5cb3b394efeefd5cac1c71d023df73e4c19a02b9de64ea1a1ae4241
AgentTesla
6eced51e9e9f798e79627188c69026a06a576021d112c8b94ed517f2576b009f
AgentTesla
6f0c98efd3149c8527cf3f700d123da142275f32c166cf2ca2b186d1acc1286c
AgentTesla
b2027562cdbec2beeb72eb09715b7615a62c0050d663eafc82de9d3461a05dc0
AgentTesla
c1fa48c0b9c81541dc2ba39db3fc1c410f6231e8df9aa69c02bdd1c8549b453a
AgentTesla
dc22665dc14ec019a9f8c421c938db597c2a1b9e439c4a0a0b6dc7b1330e75b8
AgentTesla
f740b4f32c0d32f5ee1525c3da775efdb4cc6535fc7ef372b373c9c67f32cd2e
AgentTesla
+ 734 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla persistence
Link:
https://tria.ge/reports/201022-jz2ax9vecn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
95d78a7f8ede0b8198c9b690fa4ca192a07a80eb67ee3faee1dce5aaa66349e4
MD5 hash:
99961f1f84d3596362a689c34c61dac7
SHA1 hash:
e00f15e3ca1311dff3a123afb98683c702f80b2f
Link:
https://www.unpac.me/results/e30ae015-ce77-4cae-b0f5-32e4bb4b72da/
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/e30ae015-ce77-4cae-b0f5-32e4bb4b72da/
SH256 hash:
fa56ec7f1226fc8b6ae7d9401b9ad9882b9abce03eae2f7e51601dcf925a8249
MD5 hash:
e7a3cdcd2c793810be4dc639f0ec187f
SHA1 hash:
403f8390d1e399f6858b4c41a84a0c271f920631
Link:
https://www.unpac.me/results/e30ae015-ce77-4cae-b0f5-32e4bb4b72da/
SH256 hash:
80b78daf75bcc759be5a1b08eb38fa5f5c16f3c55844d841aa57e5514dcf8e9e
MD5 hash:
afc31910e399f7d559f31257a4390b5a
SHA1 hash:
775be79a5d5f5c1b534e92d146ba333e14ea1bea
Link:
https://www.unpac.me/results/e30ae015-ce77-4cae-b0f5-32e4bb4b72da/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 95d78a7f8ede0b8198c9b690fa4ca192a07a80eb67ee3faee1dce5aaa66349e4

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/74550/

Comments