MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfdc55f5182638dff835b341613a95d335fea510ad5c322d51e6acaf30cba6cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfdc55f5182638dff835b341613a95d335fea510ad5c322d51e6acaf30cba6cb
SHA3-384 hash: ec31ff6e702e414375a3dfbedb44d267040095a3640e1befc6f04d7ee85a100c0be3eb6849ff70c9297f92fee7572766
SHA1 hash: 262d93ef8e71e0320ecc8ac9d9a16417d8b0ce8e
MD5 hash: 04290366a368572bbb6074152cf57c51
humanhash: bravo-carpet-mockingbird-carpet
File name:New PO_155717_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:747'520 bytes
First seen:2021-02-22 07:22:38 UTC
Last seen:2021-02-22 08:41:44 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:GmdYABqvkKOtAr7CNNpHaNGIr8xaAZ33s4J+DJ:7w6hNNpH05r8Y8nsO
Threatray 2'760 similar samples on MalwareBazaar
TLSH 04F4BE16B758BFA2D7299F3BC413264043F18267A332FBA75CE416E01413F4A6B6E54B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 307.gvuwx.ml
Sending IP: 143.110.148.99
From: Markilh Lesvirni <MATTEO.FORTE@nordfluid.it>
Subject: AW: Our New Order No. 155717
Attachment: New PO_155717_PDF.ace (contains "New PO_155717_PDF.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/118229/
Detection(s):
SecuriteInfo.com.Variant.Bulz.366920.28778.27767.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Creating a window
Running batch commands
Sending a UDP request
Launching a process
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/613721
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfdc55f5182638dff835b341613a95d335fea510ad5c322d51e6acaf30cba6cb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:23:09 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7ofl5iyey4n76bvwnawcouv2m275jiqvvodelkr42wk6mglu3fq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
91d67e9fafdece29f904e3dfd8852d8d26d5c6102c0b3cf556d85cdae4d5d76c
AgentTesla
9dde30eea4bc51f6561d857ecb624f09e3257c3a015ff49a8f22f206fcab45c1
AgentTesla
a1297ad5970529014466745cbb2d1615ba88de8e062e77101fab26937ac518ac
AgentTesla
a69c7080e11bb7bb263502047a550d725500b2a49a0f09d965b1586b7437572f
AgentTesla
a717f13ed10b05c55dea1f2551da0f2d2fb2e49cd153da93be3fdd618c5cee6a
AgentTesla
a997db748e940751ad67b16d4d58b0a4684c4106dd751f52df9d49bd67b9e9ea
AgentTesla
aab4d0198e57e6a91a1318310347b8a9d16d7fee076211fcb9dcb5a720a2fc71
AgentTesla
b62b3c31846f3873e712b5ca711e36f2c8ea7c8cfa587576339074eaad9583a3
AgentTesla
bdbfa9d8186cfa1a4c04fa542f78f4c794c7554e0422001f430bf0db01eab52b
AgentTesla
dc8b8addeb256bdfb0eb82d09b54b57400deed315a727e331fe66ca59c965373
AgentTesla
+ 2'750 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla agilenet keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/210222-558bfdcajs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
bfdc55f5182638dff835b341613a95d335fea510ad5c322d51e6acaf30cba6cb
MD5 hash:
04290366a368572bbb6074152cf57c51
SHA1 hash:
262d93ef8e71e0320ecc8ac9d9a16417d8b0ce8e
Link:
https://www.unpac.me/results/c7dbcb1b-485c-4724-bf43-ac56983e2d65/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 2f48dd1a97738640926dc80a1ef5db57124134144fac863dc4f8d4e8e734efc0

AgentTesla

Executable exe bfdc55f5182638dff835b341613a95d335fea510ad5c322d51e6acaf30cba6cb

(this sample)

  
Dropped by
MD5 f821a5fd566b1e62f7f317fbbf6831eb
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/118229/
  
Dropped by
SHA256 2f48dd1a97738640926dc80a1ef5db57124134144fac863dc4f8d4e8e734efc0

Comments