MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a46a22affb92f4a76e9a0356c13fd5a8468c43af1b5f3e23d563fcb17331b69b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a46a22affb92f4a76e9a0356c13fd5a8468c43af1b5f3e23d563fcb17331b69b
SHA3-384 hash: e5551fa210b392da5eefa162a1c231dbb9b7d670639bb2ac8cce248b781d71d885cd93997709bba5f1a7294e9a8624db
SHA1 hash: 802c3a1090d67bbec88ee33caefee7698eb10c38
MD5 hash: b51432831829bf84ae8fd8c74c9f2c7d
humanhash: lima-carpet-magazine-mountain
File name:picture5.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'408 bytes
First seen:2020-05-01 11:27:50 UTC
Last seen:2020-05-01 13:03:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'779 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 6144:wyYXwArWvCziuleuBvsQcQJFeRpWeBQwiEcav5qLNs2tq4ddpj4qlFy84+LX9X:w5gATziCxxc9T/BqS2tq2Tj4qv4+7l
Threatray 27 similar samples on MalwareBazaar
TLSH CC840223EF98C231DCDC2AB7567A134D577847E30091E76C8EA66D990BA7B6209313CD
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.quilounges.com
Sending IP: 45.95.168.152
From: Quilounges Inc<info@quilounges.com>
Subject: Property Purchase
Attachment: Picture5.img (contains "picture5.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48211.9270.22436.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 01:53:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=urvcfl73sl2ko3u2anlmcp6vvbdiyq5pdnpt4i6vmp6lc4zrw2nq._file
Verdict:
malicious
Similar samples:
0af44b9553823391f942810e491b2160386c70982d0ee3e5ab745ae161f7572d
AgentTesla
1dc7b9bc7fc4e17e45e76dfb99d0106802a503fcadbe1669a0fff3499a55eade
AgentTesla
274402fb25f2eef022a8c983908731a36aeddfe2f547057ea6c2e172a8523891
AgentTesla
689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1
AgentTesla
7af2440f0716f18f1d20faee99d68c25bc6e4a3eff067e759d2167aa5211221c
AgentTesla
81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8
AgentTesla
c599667585688c32aa84ecbdad1a01e93e4a92beeab76c48f1f415234ce26b6c
AgentTesla
f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be
AgentTesla
f9eb36080d1ab8f016ff0f132add3bd220f01fe6220c9ce3ef554e98318bd33a
AgentTesla
fcdc7b634a27a20fb619cc83b34c74ed0cc850f05fecbf3164ab55413d3e988b
AgentTesla
+ 17 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f236ebcbe2a48fb908aa29356eac5985ffc5bb3cfc2ca7b06e11308f9a518660

AgentTesla

Executable exe a46a22affb92f4a76e9a0356c13fd5a8468c43af1b5f3e23d563fcb17331b69b

(this sample)

  
Dropped by
MD5 cb35540dd55a68396741804dba621004
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 f236ebcbe2a48fb908aa29356eac5985ffc5bb3cfc2ca7b06e11308f9a518660

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments