MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca0b556ff44259aacea1061aec8f026cca87dd2f8e786349ce312cbc4f8690db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	ca0b556ff44259aacea1061aec8f026cca87dd2f8e786349ce312cbc4f8690db
SHA3-384 hash:	e3a7791c04be773bfa8872d81e343a0c827f64c65490610e1117c0fe522f9915ef62c17820d83424f869d4aeb686eb4b
SHA1 hash:	d047432a1dda2e4e76f8cb64b1755c68bbb7145e
MD5 hash:	88df89231db91e888c971e8f9d9dd4e5
humanhash:	sad-low-india-victor
File name:	88df89231db91e888c971e8f9d9dd4e5.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	724'992 bytes
First seen:	2020-08-02 11:08:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	927c37aff1985dca3a480112dcc5320c (11 x AgentTesla, 5 x NanoCore, 3 x Loki)
ssdeep	12288:IXjgbnMmIKCXsLIN4KKD6fpkR+ypsKtvP1QZTQC+ILopSxzb+rcQFmVkHfIXBsb3:Wkb4uLgpfpkZqkc5AftmHXeH
Threatray	11'805 similar samples on MalwareBazaar
TLSH	CCF4AF62F7A14B33C16316789C1B57789836BE10392879862BE75C4C9F39382357BE93
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

AgentTesla SMTP exfil server:
mail.papayatreehotels.com:587

AgentTesla SMTP exfil email address:
sales@papayatreehotels.com

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/37179/

Detection(s):

Win.Malware.Fareit-8701980-0

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending a UDP request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Stealing user critical data

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/407173

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/ca0b556ff44259aacea1061aec8f026cca87dd2f8e786349ce312cbc4f8690db/

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2020-07-09 06:06:00 UTC

AV detection:

28 of 29 (96.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zifvk37uijm2vtvbaynozdycntfipxjprz4ggsoogewlyt4gsdnq._file

Verdict:

malicious

Label(s):

agenttesla

hawkeyekeylogger

AgentTesla

4dd90f817154b87c0269aabb51365dfa4c57896449642d178ad19891e52b5aff

AgentTesla

70706e21df2777c92d5a20bf792b88d3152b05fab743d881b3a3311291da6f62

AgentTesla

7404e34def5b0d893557483ab19926adc1635866bdfb0682adddc3caae877e03

AgentTesla

8e7d8dc49220d4ac88858ec8401d0d2b2a0c21d7b8e301c68de51e8a99238363

AgentTesla

8eb3933e2012364a81fa9f1003c485c03c6cafd61eefaf1b4059cc8d4a4066a7

AgentTesla

c24f35c4f744e2ab5aaa0c950506bc3c9753507848d9094a3359da507a96b861

AgentTesla

db256170f60efdebefa6673fd5e985a7688c3ea5656aa827a61b9f3c600d0b00

AgentTesla

e83175d7d56084e7dde32b39f8d113f91ee1834890222dde4f987236a88b4165

AgentTesla

f5cffd780367ce051b550f171bdac33d5a4eba0b12acfac1bcfa63669c94104b

AgentTesla

+ 11'795 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

upx keylogger stealer spyware trojan family:agenttesla

Link:

https://tria.ge/reports/200802-9elck64wqe/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Reads user/profile data of local email clients

UPX packed file

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Gamarue

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ca0b556ff44259aacea1061aec8f026cca87dd2f8e786349ce312cbc4f8690db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar