MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b89dcfcb93658704c904004a6266ed755b71c233de1ee97b0026a17af3462fa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	b89dcfcb93658704c904004a6266ed755b71c233de1ee97b0026a17af3462fa5
SHA3-384 hash:	c7aa9c86c53f95aa0c4a0231facd33a24f6769ae86c0d45e3621b089a78961086391244974a48d883fb6cf6eed42c5ce
SHA1 hash:	707df6e977519821ae0f98e5038b031961446663
MD5 hash:	8ad0001ad238a43bfca88042e7162058
humanhash:	glucose-bulldog-michigan-seven
File name:	Original Shipping Documents_pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	760'320 bytes
First seen:	2020-07-29 07:45:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e8ef47e85c79ee608837cc415c05c43b (15 x AgentTesla, 5 x NanoCore, 5 x Loki)
ssdeep	12288:qRXtpnVH9Az44BnvOCDhzcl0UdKndi2bnXgIHMvwlyOyQccrZbKaa:qfd8z4byilBdlGXnHMYl6MrXa
Threatray	11'447 similar samples on MalwareBazaar
TLSH	D0F49E62B2E1C833D3672E78BC1B57649B3ABED02D3859852FEC1C4C5F396813865297
Reporter	abuse_ch
Tags:	AgentTesla DHL exe

abuse_ch

Malspam distributing AgentTesla:

HELO: vps12232936.123-vps.co.uk
Sending IP: 212.67.215.65
From: DHL EXPRESS <worldwide@dhl.com>
Subject: Parcel Held At Our Facility (Arrival Notice)!!
Attachment: Original Shipping Documents_pdf.gz (contains "Original Shipping Documents_pdf.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.Trojan.PWS.Stealer.19347.10936.15784.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/401948

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/b89dcfcb93658704c904004a6266ed755b71c233de1ee97b0026a17af3462fa5/

Threat name:

Win32.Trojan.LokiBot

Status:

Malicious

First seen:

2020-07-29 07:47:08 UTC

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xco47s4tmwdqjsieabfgezxnovnxdqrt3ypos6yae2qxv42gf6sq._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

1213bf9b96c3be3807bcc5a361f913dda92aa985ab0d09cec4d4b75dd78f6dd1

AgentTesla

28f4c1738d5f9ed88b07a8266e674c22abb35e74bca8dc3fa6f1679f14f2a43f

AgentTesla

30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4

AgentTesla

41f6638f1e6ad1d8aee7d3d0ccd9a39af59e340b2ad2074d25d72dc8556855d6

AgentTesla

4b2ba5e0907fa5c1cbfd980bee03483ccce1d11bdcf924e90de7a7c72ded2ef9

AgentTesla

534448acf886c50b7172a770f596924c2924dd229867f7e94e3f5250adde47fa

AgentTesla

6c198cde01215ddc3644821cac16edead4b41dcb19f2ea0639e57b27347b8b78

AgentTesla

9ebeb5ba44225161419dd3306fc3dcd8aae12ca658e582ad3e5b3c6bd744bca3

AgentTesla

b2c27e47afb94c3bebf71559a6fd0195ad330f4fb126bf7a2002c6c1ba995dd4

AgentTesla

+ 11'437 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

upx spyware

Link:

https://tria.ge/reports/200729-sxzj7zve9s/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b89dcfcb93658704c904004a6266ed755b71c233de1ee97b0026a17af3462fa5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar