MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b
SHA3-384 hash:	eed92d1496a8fad57a055baf85b8221d7105201466d5d45f20afb7f18cf48c096aa8aa0da05e5db18c411c84f056b4df
SHA1 hash:	3deca166a4f53e9d6c7e9b4deed0e3874af19f79
MD5 hash:	948773c32d00d9e91eda82e4ec2dc6ae
humanhash:	neptune-mango-jersey-july
File name:	SUO0998900.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	634'880 bytes
First seen:	2020-12-02 09:11:40 UTC
Last seen:	2020-12-02 10:50:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	6e3086672ec8625cc086cf37febd4303 (4 x AgentTesla, 2 x Loki, 1 x Matiex)
ssdeep	12288:srnxwd1mcSRQXzFNmxy/szw8LoXewswg+QgQhyLKSgKws0N:w81ndmuszw8sOwsMQQLK8wsa
Threatray	12 similar samples on MalwareBazaar
TLSH	A8D401103481C03BE8B301774EBA5B6A923EBCA2476664D3B7DC5E994BB51E07B31367
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing unidentified malware:

HELO: gocmaksan.com
Sending IP: 185.222.58.152
From: handan@gocmaksan.com
Subject: PURCHASE ORDER-02/12/20
Attachment: SUO0998900.zip (contains "SUO0998900.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/106353/

Detection(s):

PUA.Win.Adware.Bang5mai-6804572-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a file

Running batch commands

Launching a process

Sending a UDP request

DNS request

Sending an HTTP GET request

Sending a custom TCP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla Snake Keylogger

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/553374

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected Snake Keylogger

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-12-02 09:12:12 UTC

AV detection:

35 of 48 (72.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vernnjs5244ndryvujkkfysxwhbvwadaklxee33divmpchnzdvnq._file

Verdict:

unknown

AgentTesla

074537cdfc152eb16c1bbb1272e6812837f0918dde7ad9ab401ec52b0b2e5c5b

AgentTesla

5952cc403a58eab272b199a6f39c35bfadf8feeafbadc1a3d30a68e01e93b7ae

AgentTesla

5d24a0a0b3827fc646d7f7da98a5db2a8d76bba9761b4c91ab968cc67ceaf194

AgentTesla

6093b99ac39503f585b6a7ed7e20727c24a784a7a93c181596209054a561ad71

AgentTesla

ab612a8fe6f624d7d590420fc47a96b99aaa0097d4d78f438fee11cd41552305

AgentTesla

c4419fe8bcf0371cefb5b778b2600f307234493e02ce432aae1cc0a7d32e0711

AgentTesla

c9c6ab014615422f9d6def268a9c0c17172882d4319c3261c66341bf31ee1ba8

AgentTesla

ed0854c940f926f1e0fffedbb7932712a8abe8f23900d1cc27db06c1699221c7

AgentTesla

efcd8b4258174d99d21ed0be8a946ca98787e58543194208301af6189ae39f84

AgentTesla

+ 2 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201202-thf2yyrg6a/

Behaviour

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

f428efea6196b65767f4453240e2a489d10b0f058dc72d22f9dbcce47b2bd317

MD5 hash:

0da876610ed1111e44462f5602e2c73b

SHA1 hash:

135f9461c4f1f395ab06eaf9fb88ea17d490c681

Link:

https://www.unpac.me/results/bcb9c5e2-b954-4cdb-86c0-dae38a0e263f/

SH256 hash:

a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b

MD5 hash:

948773c32d00d9e91eda82e4ec2dc6ae

SHA1 hash:

3deca166a4f53e9d6c7e9b4deed0e3874af19f79

Link:

https://www.unpac.me/results/bcb9c5e2-b954-4cdb-86c0-dae38a0e263f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a922d6a65dd738d1c715a254a2e257b1c35b006052ee426f634558f11db91d5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.