MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704
SHA3-384 hash: d0a6ff782a129b64ba0b11e73f2b8d6c1f41df91c9263878d84b10bf1fe9e2066d916b434b4d258d68f115efa02a5de5
SHA1 hash: af67b05bcd4b7c1fd3e0df1543d8ea85baf7aa26
MD5 hash: 00317e6f5d589577dcdf2026c1c6ec75
humanhash: vegan-maine-juliet-virginia
File name:Delivery Note - AWD 200038485852- 2349203968876 .exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:630'784 bytes
First seen:2020-10-06 06:32:25 UTC
Last seen:2020-10-06 08:12:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:KvCffUZzVsWcHxePEi0VeXx6xIAaEcytkWHicD6vR:yCf8tVP9UA61a6kvbvR
Threatray 342 similar samples on MalwareBazaar
TLSH 7AD4F15A23B8D715E57E577A6420502033F09D07A362F69DFEEA61ADEC23B80CE61B41
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.greekwebhosting.com
Sending IP: 67.225.208.195
From: DHL Express <katewright_dhl@gmail.com>
Subject: Re:DHL Failed Delivery Notification
Attachment: Delivery Note - AWD 200038485852- 2349203968876 .gz (contains "Delivery Note - AWD 200038485852- 2349203968876 .exe")

AgentTesla FTP exfil server:
ftp.superdragooncar.com:21

AgentTesla FTP exfil user name:
dod@superdragooncar.com

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68493/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/482479
Signature
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 04:12:03 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3ppfr362v6hricoa5coxv35nuw7w5bso3fihq46xonp3eysg4ca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
125203c92ab4db76de740b9cb2ce5908bbf6ee86864855a4903e2d5c17953ad1
AgentTesla
1eb61b56f976e2b47aa77a2e84c86dd7050369f99b54f767ae9d5448c53c6294
AgentTesla
3ee59149caa2a1f67159eb37aca56d4e1019ea5b33851c5b724a4911c0b0b4d7
AgentTesla
59bbe3f3c9d04d180126b1396dcda25f533a491a92255ffdfca4acb6a6ca7bfa
AgentTesla
6e070df16a98956dd19b7313c542a8462704f95b8aeca246625d3a2cda152ba6
AgentTesla
8ab355a4e825d4b233ce66f8e5f5b75b4c161cbb25f070f3355b6b15625dc784
AgentTesla
8bd54fdcad070997915f4a6dfa945f13f84f98adec76849087add2251417703c
AgentTesla
9a09e075c72d1054035ab56fc790933d097a8a3986e0a1eca8b925606d304956
AgentTesla
9d9e3278180f9d8b038c943eaf74a91002f30ff456bc7e8dfef40ef1a4e8fb4a
AgentTesla
fa2bcbff57b3c111ea69b6f47cb4f39c4111b124ef97e3ee00347a175f67e93d
AgentTesla
+ 332 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201006-vde88xbm3n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704
MD5 hash:
00317e6f5d589577dcdf2026c1c6ec75
SHA1 hash:
af67b05bcd4b7c1fd3e0df1543d8ea85baf7aa26
Link:
https://www.unpac.me/results/d2c734a4-e8b9-4c02-a4a6-6f79afe075f2/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/d2c734a4-e8b9-4c02-a4a6-6f79afe075f2/
SH256 hash:
da7f20a92e39e24b27c89aad50d5d0429f1561d9ff60b484eb8e6b760a71bb71
MD5 hash:
4fbad45fef90970594430d09ba2cc472
SHA1 hash:
0f9bf7fb24da6010bce721b1f2c0b07124f51215
Link:
https://www.unpac.me/results/d2c734a4-e8b9-4c02-a4a6-6f79afe075f2/
SH256 hash:
5fac9b74e38f6e664da8fc75feca01567a1d4a8cfc6b084f99cde517edf6f961
MD5 hash:
db8316c6460be683168df05aa6648cdd
SHA1 hash:
747099b34e3156356adea20e75ad05d291768be6
Link:
https://www.unpac.me/results/d2c734a4-e8b9-4c02-a4a6-6f79afe075f2/
SH256 hash:
536a3ed0d3fb0b8e0cb2a7fb2cfbc4af59af6dc65889224bc769f2fbfc1418d2
MD5 hash:
1feadf726713f30ee5ecc269bed09aeb
SHA1 hash:
88e5be3bcee669dd947ce0429ceecf18ac46d8ac
Link:
https://www.unpac.me/results/d2c734a4-e8b9-4c02-a4a6-6f79afe075f2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ebd707b692a17843a3c145f58f89a2d4a9a313726d5183ab61bb7922e9732131

AgentTesla

Executable exe aedef2c77ed57c78a04e0744ebd77d6d2dfb743276ca83c39ebb9afd93123704

(this sample)

  
Dropped by
MD5 6ed2f629d47ba4fa9fe8eb5c905d47eb
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68493/
  
Dropped by
SHA256 ebd707b692a17843a3c145f58f89a2d4a9a313726d5183ab61bb7922e9732131

Comments