MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9add2a18d24644570fc7a754eb3e72052ada8d540bd23be205eb501bf3f02a31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: 9add2a18d24644570fc7a754eb3e72052ada8d540bd23be205eb501bf3f02a31
SHA3-384 hash: c386864c635deee3a3b049a45c33775e166312cd986887124e57e753e9fe3b33dec9875283d9bf3644477b411637fc23
SHA1 hash: b908a4ca5925548e62d8bbf194de7ca0b47d62e7
MD5 hash: 4a772b183e9988be868319c441faf55e
humanhash: west-network-cold-rugby
File name:Order purchase list.exe
Download: download sample
Signature AgentTesla
File size:412'160 bytes
First seen:2020-06-30 12:43:13 UTC
Last seen:2020-06-30 14:25:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:9MH1LBl+fkQcLAjbaIwW1x0yl+Y5hg/47c+:9MH1Lf93y2JWc4OO
TLSH CA940232B3F5CB1AC6B9D3BA11B054100FB6B9933510E65E6D6864CF4EB3F648261B27
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 209.58.149.71
From: Accounts Department <rud-division@alkuhaimi.com>
Subject: paid invoice
Attachment: Order purchase list.z (contains "Order purchase list.exe")

AgentTesla SMTP exfil server:
mail.sensar-light.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 29
Origin country US US
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17155/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/9add2a18d24644570fc7a754eb3e72052ada8d540bd23be205eb501bf3f02a31/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Agensla
First seen:2020-06-30 12:45:05 UTC
AV detection:22 of 31 (70.97%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   1/10
Malware Family:n/a
Link: https://tria.ge/reports/200630-9rmw8xq2gj/
Tags:n/a
VirusTotal:Virustotal results 18.06%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

776f5ab4958768bae17087e937d9660d

AgentTesla

Executable exe 9add2a18d24644570fc7a754eb3e72052ada8d540bd23be205eb501bf3f02a31

(this sample)

  
Dropped by
MD5 776f5ab4958768bae17087e937d9660d
  
Delivery method
Distributed via e-mail attachment

Comments