MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b329339955fe03c374ef32667a175ff2d0a8ac1df1b930f7afcc1e44bed3d89c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b329339955fe03c374ef32667a175ff2d0a8ac1df1b930f7afcc1e44bed3d89c
SHA3-384 hash: 004f3eb2a0af06eefd6515c565fc6ab1b51b1fd7b564f96e6fc44a6092f2b3f4d952be8ffc5f40cfa452ade863fa4537
SHA1 hash: d5bd56d87c1ca0659307d436609b13feff90b8f8
MD5 hash: 512cada2c830555baf6a399aa1fc9caa
humanhash: hawaii-avocado-fish-bacon
File name:PURCHASE_PRODUCT_LIST2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:871'936 bytes
First seen:2020-10-21 07:03:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:XEOKDE599eaXHDDXIXT2iNoRLWROZN+pMD+gzRcm50LoGu0RPpfAVjI4lkmY7Rre:Y1KjN+pnEYor0yIqIBIQ0
Threatray 706 similar samples on MalwareBazaar
TLSH B605DF3935E9BF10E17D063BC86158608BFAEC079A22D5AE7DCC399D1FB1BE44462702
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: demokritos6.cytanet.com.cy
Sending IP: 195.14.130.216
From: lilian@nbsglobal.co.za
Subject: po
Attachment: PURCHASE_PRODUCT_LIST2020.rar (contains "PURCHASE_PRODUCT_LIST2020.exe")

AgentTesla SMTP exfil server:
mail.purseyboucher.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73871/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/505322
Signature
.NET source code contains very large array initializations
Contains functionality to register a low level keyboard hook
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 301687 Sample: PURCHASE_PRODUCT_LIST2020.exe Startdate: 21/10/2020 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for dropped file 2->62 64 Sigma detected: Scheduled temp file as task from temp location 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 11 other signatures 2->68 7 PURCHASE_PRODUCT_LIST2020.exe 7 2->7         started        11 Windows Update.exe 4 2->11         started        13 Windows Update.exe 5 2->13         started        process3 file4 40 C:\Users\user\AppData\Roaming\FACSKKC.exe, PE32 7->40 dropped 42 C:\Users\user\...\FACSKKC.exe:Zone.Identifier, ASCII 7->42 dropped 44 C:\Users\user\AppData\Local\...\tmpA16D.tmp, XML 7->44 dropped 46 C:\...\PURCHASE_PRODUCT_LIST2020.exe.log, ASCII 7->46 dropped 70 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 7->70 72 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->72 74 Contains functionality to register a low level keyboard hook 7->74 15 PURCHASE_PRODUCT_LIST2020.exe 17 5 7->15         started        20 schtasks.exe 1 7->20         started        22 Windows Update.exe 11->22         started        24 schtasks.exe 11->24         started        26 schtasks.exe 1 13->26         started        28 Windows Update.exe 2 13->28         started        signatures5 process6 dnsIp7 48 elb097307-934924932.us-east-1.elb.amazonaws.com 23.21.126.66, 443, 49750 AMAZON-AESUS United States 15->48 50 nagano-19599.herokussl.com 15->50 52 api.ipify.org 15->52 36 C:\Users\user\AppData\...\Windows Update.exe, PE32 15->36 dropped 38 C:\...\Windows Update.exe:Zone.Identifier, ASCII 15->38 dropped 54 Tries to steal Mail credentials (via file access) 15->54 56 Tries to harvest and steal browser information (history, passwords, etc) 15->56 58 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->58 30 conhost.exe 20->30         started        60 Installs a global keyboard hook 22->60 32 conhost.exe 24->32         started        34 conhost.exe 26->34         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b329339955fe03c374ef32667a175ff2d0a8ac1df1b930f7afcc1e44bed3d89c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 16:07:53 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmuthgkv7yb4g5hpgjthuf276likrla56g4tb55pzqpejpwt3coa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1011042b7b2b5de9a160551cd8a212a24108b85935744f0cfbe29f8729b57d17
AgentTesla
38d67003a3e33b0ff622758a04b631ac24d0f55f04c007834fd61bf8c2e9074d
AgentTesla
5017799e48545886ac896d038e3e9706fa65fb8a8644be0879279fe608dbdf66
AgentTesla
54a48d5630f8a4ca57c1107678b3cb68ea03e80878db3dc2ddb9d92227ad542d
AgentTesla
69b99d16f072c6ab2687da255681f3f1c3a97746bfe516b206644a5056a99425
AgentTesla
867ec49152a23a8e5ea628a48ec1810db588a716b922e6d1c8e7c45116908d24
AgentTesla
a02051e8bd0706ecb404bcc7df771bc035228890fc2ac09e1b2d02e686136520
AgentTesla
a7154f13f8a8a66f47afafe4099e6e760aef60af8eb8d66de0d8ee83cfe1ef8b
AgentTesla
ba495069a1b601a12f32f6e346dfe60958f73caa0048fb702e357fee17d58d54
AgentTesla
c5bfbac52396976e672116e5fb07d6cae05d2b07b749d08283a26bcf29677dbe
AgentTesla
+ 696 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence spyware
Link:
https://tria.ge/reports/201021-4ehnlk1hjs/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
1e18ca1d0f6663ef320e09807ad7fc9b7632ac20fd3d0074f7bee0eb8f3ad736
MD5 hash:
b6d35561c30823c7273594d24f00d69a
SHA1 hash:
76a91186734cdcdd8d2c251127590d3dac017fb1
Link:
https://www.unpac.me/results/c3ec51c8-8270-4444-b3d4-da4d5e08ad8e/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/c3ec51c8-8270-4444-b3d4-da4d5e08ad8e/
SH256 hash:
fb6855a4b3cdbabdc5193357eba380265cc5f5df053feadd59fc450cefc7757c
MD5 hash:
4111e0bd06db24cf013393642752c519
SHA1 hash:
f882a7696d88e33da13d7a399f128ec3c4d337af
Link:
https://www.unpac.me/results/c3ec51c8-8270-4444-b3d4-da4d5e08ad8e/
SH256 hash:
c960395b52812d98ec9bc62cf635144904660cfd0f073202695e5a23027938d5
MD5 hash:
a9587c2227bfcc6710dc2fe86cca05c6
SHA1 hash:
fcbda9bb1079f247cd7b60a0f4bfbbca76f89f58
Link:
https://www.unpac.me/results/c3ec51c8-8270-4444-b3d4-da4d5e08ad8e/
SH256 hash:
b329339955fe03c374ef32667a175ff2d0a8ac1df1b930f7afcc1e44bed3d89c
MD5 hash:
512cada2c830555baf6a399aa1fc9caa
SHA1 hash:
d5bd56d87c1ca0659307d436609b13feff90b8f8
Link:
https://www.unpac.me/results/c3ec51c8-8270-4444-b3d4-da4d5e08ad8e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar cba8591d77e2c2d915ed06769d2b0a728b9da8f03e5b103f7383223d65c6b91f

AgentTesla

Executable exe b329339955fe03c374ef32667a175ff2d0a8ac1df1b930f7afcc1e44bed3d89c

(this sample)

  
Dropped by
MD5 ff6df98307430ffc0e6889099965f327
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73871/
  
Dropped by
SHA256 cba8591d77e2c2d915ed06769d2b0a728b9da8f03e5b103f7383223d65c6b91f

Comments