MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3
SHA3-384 hash:	f445ce5180665b953a94bafdf6800d13279302ab19707def0851e17fc0ce93f30a86aee2900096508afa4c96d3d7d9a3
SHA1 hash:	3c7ff589a9f7f4b69ba22b4a81d6b62570dca154
MD5 hash:	4ea63f4d25e95697fbecb8f61b2c08e2
humanhash:	colorado-whiskey-one-sad
File name:	Inv no SI 18121662..exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	547'328 bytes
First seen:	2020-10-08 12:39:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:1TP4MbHE30bMb7tkY/Iee8S6aujbCnWGx/:1JbHE30buuY7e8QujbCj
Threatray	406 similar samples on MalwareBazaar
TLSH	BFC43915BB49EAB5F09E01B084D2C1F64312FDDE5982A22A6FC5BF1F35B3644005FEA6
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: success.herosite.pro
Sending IP: 23.111.148.162
From: sells@diamondeng.in
Subject: Payment advice
Attachment: Inv no SI 18121662.rar (contains "Inv no SI 18121662..exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/69220/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Unauthorized injection to a recently created process

Creating a window

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/485392

Signature

Antivirus / Scanner detection for submitted sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3/

Threat name:

ByteCode-MSIL.Trojan.Ymacco

Status:

Malicious

First seen:

2020-10-08 06:36:35 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ye7vetwbfhy5ctqqz6o6gt66rx6beh5v3azcoll6z3v5tizlo7bq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5a6ff674194fd8f0b7221de0d402f383eec634054768bd2df0e7adc2fa825953

AgentTesla

8defc26c3fad9953293008069e733fc37d2069edefb6ab84c0a6dea168e8c963

AgentTesla

8ee2c58f8a8fc555dc2be25df0f819e83f2c6c36a7513c18ddafe160ac94bf11

AgentTesla

c8ef5faf8bef2942260f56a7bfca916280711c776ee19bf00954ebdee11804ea

AgentTesla

d533947ea02478e71f86ece97892e0f87c0bd966395047a6e770158642134f18

AgentTesla

d5e9d940acb96f85e1adb23b7ba12ef45487b995e304f3b2a5b577b4b37d52fd

AgentTesla

d7f3cc72163e809b398c83abb04b237d3f900fee8886e862995a2e5995c3d627

AgentTesla

db2aa0c18078e1b88151524bd9a42092d6ad226867b128bf6b261084bc99698f

AgentTesla

eff9f4e21fdbfe198940895948ec41f1d8e5adb4686fb4f7e72b6e9042054889

AgentTesla

+ 396 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware

Link:

https://tria.ge/reports/201008-xfqtdk73gn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3

MD5 hash:

4ea63f4d25e95697fbecb8f61b2c08e2

SHA1 hash:

3c7ff589a9f7f4b69ba22b4a81d6b62570dca154

Link:

https://www.unpac.me/results/952f4a2b-a5dc-43fb-8a14-70f1a6a69726/

SH256 hash:

f81a676213d3be20a7d4e7de1887a9d3583996193748dd09b5d7447b57a0151a

MD5 hash:

1c01d2973a21a6fd4dde862290d30a98

SHA1 hash:

c1c7e3d06a11d358ed0473a3472b2d4fcc831ab5

Link:

https://www.unpac.me/results/952f4a2b-a5dc-43fb-8a14-70f1a6a69726/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.94

Link:

https://yomi.yoroi.company/submissions/c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.