MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3e501926c12ab2f5229619940c2c4e296e85a06606e69f575a00932c3d1ed30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3e501926c12ab2f5229619940c2c4e296e85a06606e69f575a00932c3d1ed30
SHA3-384 hash: a2f6c889b19c49ac8d8a7f5a7c087bd8d80b48c750cda16d705374c15eda1eebaf251e356b879846e780c1b8cd3d6741
SHA1 hash: b14dd84aec486a505146599911400b4b8122fdfe
MD5 hash: 5ab1a26998d13e0f73c55f5148564157
humanhash: hotel-coffee-pizza-carolina
File name:lecture.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:310'272 bytes
First seen:2020-04-29 17:55:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:taNfDPa1SckRkJUUOYSqWRd0rxnoMY87FgKuX+HGid8vdBb:taNb1dEg0rx5F2X+pY
Threatray 10'537 similar samples on MalwareBazaar
TLSH 7964297DAB88B902E23D097355D1622052F1D4835E12C34F6EC82FF8FF597C9694A3A6
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: javainc.accesscam.org
Sending IP: 104.168.147.51
From: imports <imports@aguacateradelsur.site>
Subject: Purchase Order US103553 - FAN / RFQ US1019-015R2
Attachment: lecture.zip (contains "lecture.exe")

AgentTesla SMTP exfil server:
mail.tule.es:587 (91.134.184.222)

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 18:36:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2psqdetmckvs6urjmgmubqwe4kloqwqgmbxgt5lvuaetfq6r5uya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
163ad84d7db148a5673e87d8134a699577c55518b6313a8ab81dc61fe0ca6eef
AgentTesla
4891ec1fb0814af4400e57d859557c72d0f0d3a3ccbdd4dc49b665697abb9a8d
AgentTesla
4b5476d1b1fb4ba019b8e7620f3a2194000d56db26196f5a94014a78f3cac669
AgentTesla
55f79a0267457cdf7267d3bedb41b02b602ba6602d70e954f4eac4dae4d48de7
AgentTesla
5b2f796db5d3322f176c2b15d340883f3cdda75a452652a782632203db58d733
AgentTesla
5c0435e674c08de5bfb78dbfdf4e01716a91780c4197bec1b3c3309361352058
AgentTesla
67a7404a31223af4f376b78228762c3de9b8f46226e61e939e24e0d6d16a67b4
AgentTesla
806f31221f182e4a97f68f267894aa671f18f5a8a112bf70ec1f64fd078b8000
AgentTesla
f07aed18918f5951cd2dd040aa2a515992e27c7d78a67b564a0b8e2f24ef348a
AgentTesla
f4ce706bea83c92bea67552077d4b3d9c1d1d58add3d8a53763cd5def3b23138
AgentTesla
+ 10'527 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d830e702ea23f89ed7c45d2ed86d28af5200bf29dbaacf7f1a150458320c9fd9

AgentTesla

Executable exe d3e501926c12ab2f5229619940c2c4e296e85a06606e69f575a00932c3d1ed30

(this sample)

  
Dropped by
MD5 945974f942c444cfb6d9e01bd37587da
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d830e702ea23f89ed7c45d2ed86d28af5200bf29dbaacf7f1a150458320c9fd9

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments