MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bce2ea2d104a5da7bfa34d0a5157893ae62b5d009783e62e7a557a22ba0c807a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bce2ea2d104a5da7bfa34d0a5157893ae62b5d009783e62e7a557a22ba0c807a
SHA3-384 hash: cc0a0f8554ce294ce10d4e92f10865be7ca809b75323bfe430776003389a0354274bd30dcf02f6598c6951c60a83a85e
SHA1 hash: 689f8194267c7875428a59eab08cb3bbbeda1c5c
MD5 hash: 35d1d97cc2a4ee3ae37c59bfd4bc4ab3
humanhash: echo-video-four-eight
File name:AWB, P.LIST, INV#082020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:749'568 bytes
First seen:2020-10-27 08:57:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:lin03Jq8HcD+jri8ypLnelYDNUBgJq3ld86uk9s93LP7r9r/+ppppppppppppppZ:R3Uuc6jbwlcgkUtk9S1q
Threatray 788 similar samples on MalwareBazaar
TLSH 65F4CE80E5852AA1DD589BB16A36CD3582337DBDA838E81C59ED3E673FFB3931121413
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.nestorhosting.in
Sending IP: 209.42.195.232
From: Import & Export Co., Ltd <Emily@jiasun.com.cn>
Reply-To: info@saapec.com
Subject: Re: AW: AW: AW: Shipping Documents – Packing List & Commercial Invoice
Attachment: AWB, P.LIST, INV082020.zip (contains "AWB, P.LIST, INV#082020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/79716/
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.28755.4420.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a file
Unauthorized injection to a system process
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/513107
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bce2ea2d104a5da7bfa34d0a5157893ae62b5d009783e62e7a557a22ba0c807a/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 21:45:41 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xtrouliqjjo2pp5djuffcv4jhltcwxias6b6mlt2kv5cfoqmqb5a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
19cb1d89fb670dd31ceae6e0c41ffcf47767f6b3779804841f7aaf75adcd028f
AgentTesla
2c4f7516214ad84b31d2468ff496720193ea743bdb260287e2ef9ec48014b493
AgentTesla
38d67003a3e33b0ff622758a04b631ac24d0f55f04c007834fd61bf8c2e9074d
AgentTesla
67e8fcfa65a48b5ef7288e91ac8ddab1180cf33150471357485511509955413c
AgentTesla
757d376a5edc5d260ab3fb209797dbbdf3ce43f6331432174b1398f14e723e20
AgentTesla
8348c6c60034429d7bca499c5cfb52d04f0705cda36665cbff5db267958811ef
AgentTesla
b2e796c1f6b0e0d824d6b212941ba3d421452f2e9a37ad98c391ba5761de7e22
AgentTesla
bd5f6e5567639e5e1c4619a02ff2db2eb3242cd6e25e50f7b7559202fc7f061c
AgentTesla
d7278dd12e9b1509a3e041aef2b8a1e13e515317ee3e8e75ff8aaa4dd5c5a6d5
AgentTesla
e6793974644f3523b0e79add22e915ae65bcda618b397dd42a6877d2b3e9e2c0
AgentTesla
+ 778 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201027-b5nhzyzak2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
ServiceHost packer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5ea032bae589090e2cfb344953ab9adc4eac2338dd36dd329ac65047f9cfe2ab

AgentTesla

Executable exe bce2ea2d104a5da7bfa34d0a5157893ae62b5d009783e62e7a557a22ba0c807a

(this sample)

  
Dropped by
MD5 0c83527be6a5b5fdd5135ce770d445a7
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 5ea032bae589090e2cfb344953ab9adc4eac2338dd36dd329ac65047f9cfe2ab
Cape
Cape
https://www.capesandbox.com/analysis/79716/

Comments