MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f
SHA3-384 hash: 6992814b701304638c28b7133a800fb06d2f9989dfd9d52852b8aea6d8e9c1f8d7a69d67b80bb4af6b60d46c607032e0
SHA1 hash: 0c55a9233f065d07bbff3bd729b27584f3be6c6d
MD5 hash: 2b270f0e6d44f4fe0a9663de744e8a00
humanhash: winner-lithium-harry-alanine
File name:ig0dFbTPvdZl5so.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:596'992 bytes
First seen:2020-10-16 10:53:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'603 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:Ba8oEvP0MB/TqjM7InLIw9Qz40pMnqLW3WwUIFK:UbEvP0MJTp7YkwOz40MrmwUY
Threatray 581 similar samples on MalwareBazaar
TLSH B5C4E03563A8EF94E13D67B220B4509047F5F192E722D60E3EE013DD29A2F505B73B6A
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fgimaging.com
Sending IP: 37.49.225.239
From: "Joannel" <joanneb@fgimaging.com >
Subject: INVOICE
Attachment: INVOICE.rar (contains "ig0dFbTPvdZl5so.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71936/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493476
Signature
.NET source code contains potential unpacker
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299193 Sample: ig0dFbTPvdZl5so.exe Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 29 Found malware configuration 2->29 31 Multi AV Scanner detection for dropped file 2->31 33 Sigma detected: Scheduled temp file as task from temp location 2->33 35 8 other signatures 2->35 7 ig0dFbTPvdZl5so.exe 7 2->7         started        process3 file4 19 C:\Users\user\AppData\...\ZCRpNWrZyCzmaF.exe, PE32 7->19 dropped 21 C:\...\ZCRpNWrZyCzmaF.exe:Zone.Identifier, ASCII 7->21 dropped 23 C:\Users\user\AppData\Local\...\tmp40F9.tmp, XML 7->23 dropped 25 C:\Users\user\...\ig0dFbTPvdZl5so.exe.log, ASCII 7->25 dropped 37 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 7->37 39 Writes to foreign memory regions 7->39 41 Injects a PE file into a foreign processes 7->41 11 RegSvcs.exe 2 7->11         started        15 schtasks.exe 1 7->15         started        signatures5 process6 dnsIp7 27 mail.privateemail.com 198.54.122.60, 49751, 587 NAMECHEAP-NETUS United States 11->27 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->43 45 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->45 47 Tries to steal Mail credentials (via file access) 11->47 49 4 other signatures 11->49 17 conhost.exe 15->17         started        signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 02:26:03 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yvmjktumjjgdv6mievsvx2oufrj4cdabrdqo4qzji4o7nglskm7q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
047f0957dbc1979767e320b2f91449d21a3afb5c673863c8ed28eadbf919538a
AgentTesla
0d880bcb9954785c7d6ab96de5f4baa06118fa3087c759b272a35c6a34298c18
AgentTesla
0efd6cebb9ad89cf2d4ab29e97ab977af7781ba113a056be46761c8da39f554f
AgentTesla
306dc076ebd63fe8d969a99984470c480737e86eba1fb55ebe1ef49a8b987565
AgentTesla
44de8368a07efe44888bfe4b83a307c6002a0c4202a02150d884248c8b8ae75d
AgentTesla
845843a97512af3f6c1de5399010118465145957916aade4dc299fc317e13858
AgentTesla
be277d6a90d21afd8f3ba568d694850f7ce2067fb21c688e321103a3f4e8f80b
AgentTesla
d6eae805f732c5c0c2166231af84295978fbcfb8d8130aebf78fd95cde18167a
AgentTesla
d7c413a17b18a3ce5b4fbc679ea4f141a31b77f4c13962bc7ad4f80a4df03cd9
AgentTesla
d8eca36ecff579ceffbd778ab8c8949a94d4967e1c0965988b2a68671f1915ef
AgentTesla
+ 571 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
evasion
Link:
https://tria.ge/reports/201016-cl2lp78k4x/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f
MD5 hash:
2b270f0e6d44f4fe0a9663de744e8a00
SHA1 hash:
0c55a9233f065d07bbff3bd729b27584f3be6c6d
Link:
https://www.unpac.me/results/2d3c335f-68fd-4f44-b09b-1d6ab404879b/
SH256 hash:
15755abe2dca2ebe2ed5c3bcf3c36fde188b60a7faee8bfc5d004912ca9203e9
MD5 hash:
d4374c917315fd5270578f5350bd52f7
SHA1 hash:
81c02dafa7e256e5158ed1d911f3901bd5b16b64
Link:
https://www.unpac.me/results/2d3c335f-68fd-4f44-b09b-1d6ab404879b/
SH256 hash:
c3f62be4c81de5dcc98ad0f6743b9dfb3398923416b64699c68bcef53f138d65
MD5 hash:
c8071edc1c51508807c1d4dfd29917e1
SHA1 hash:
a12e92ff578cf7558c51996b4d7747663f4769d5
Link:
https://www.unpac.me/results/2d3c335f-68fd-4f44-b09b-1d6ab404879b/
SH256 hash:
75d6cf1f60e3fc9467d0461c7bfb2930171963a40a77cf16089552c7760b23d9
MD5 hash:
f48c7096d41e30e812c974598aefbd74
SHA1 hash:
be1fb24d28946bbd7769b5a9267e0a55bf67733e
Link:
https://www.unpac.me/results/2d3c335f-68fd-4f44-b09b-1d6ab404879b/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/2d3c335f-68fd-4f44-b09b-1d6ab404879b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8584cf5fbaf9ce72a4ca8b991066ae2d7370814a92d19ab74e30a83a845f3ea6

AgentTesla

Executable exe c558954e8c4a4c3af98825655be9d42c53c10c0188e0ee4329471df69972533f

(this sample)

  
Dropped by
MD5 efa647d276a1617baa3892e4a5a2a528
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71936/
  
Dropped by
SHA256 8584cf5fbaf9ce72a4ca8b991066ae2d7370814a92d19ab74e30a83a845f3ea6

Comments