MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6eea8b54ef6a2b96f24a5dcbe28b84982bbd9e8bef9008e9f30789ff532afe8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6eea8b54ef6a2b96f24a5dcbe28b84982bbd9e8bef9008e9f30789ff532afe8
SHA3-384 hash: ae8bf9dda76b7b4ab21a2cfb4b729fecaeb3ce504306f672531cc6e9a3d4dc0d29cc5336b890366d44bb475d16622523
SHA1 hash: adeb8a6cfa18fcc1862ea131ce0292f921cbe6ed
MD5 hash: fe5389e5fd0c2a94969b1125c51a6f0e
humanhash: undress-golf-september-six
File name:RFQ No. PH.RS.198.2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:441'792 bytes
First seen:2020-04-07 15:09:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 24f4223e271413c25abad52fd456a9bc (21 x GuLoader, 15 x Loki, 10 x AgentTesla)
ssdeep 6144:OQA4s4QYTaosZVni8DJ9DoPdcB52gOUO2BeDrwbscfdKHLFOPdEsSn4UI9M23ri2:2YAZhi8I7BtfwbsHLQEsmAN26iE7
Threatray 364 similar samples on MalwareBazaar
TLSH 5D9412026780E5C7E8584A7107B2F899DEDFCD3BE4A0C50F12927E76AE686C7906174F
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic_S.2588.27690.UNOFFICIAL
Create hunting rule

Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/337725
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-04-05 21:03:36 UTC
File Type:
PE (Exe)
Extracted files:
53
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3xkrnko62rls3zeuxol4kfyjgblxwpix34qbdu7gb4j75jsv7ua._file
Verdict:
malicious
Similar samples:
088999945f71cb731f4fa4d6e73591ecdf1829306a6dca66be75947fc0c8d00b
AgentTesla
198d05241ee46346a622e687e628fbdbe7185db3a206eaa7883b5f18f0095de2
AgentTesla
44b2a6748bfe73b0e4515854def74fbd816ffa56842e3b544438cb34a249a41c
AgentTesla
46a8cd49147840874de19fba4807e2780189fa7e81b58fe01013b69f6aca34ac
AgentTesla
574244157302423f04971fb2c348a4ae598a67b15f1a2edda0b2ea3cfcc0a4d9
AgentTesla
60952b7b0b3edeb47b07f1d2a0fb87856b165550e47c605c4ef4fb1da699a332
AgentTesla
6b1df4cb218093a57a5646f0d6ece41d548fae6cce51d90d1540686d747069b6
AgentTesla
a89c531ad157965de03cf15ab2783f0b24e6db0981556a7bf5ad8fe5c7d66ef5
AgentTesla
b5bcbfe8ba02879ac963d4f9ed48203c934e80edb58b814129ad836544f2c3a3
AgentTesla
d87e7752ee36b46b902d88317b5c5b172927760a4f171c95f812991ec62ae963
AgentTesla
+ 354 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe b6eea8b54ef6a2b96f24a5dcbe28b84982bbd9e8bef9008e9f30789ff532afe8

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments