MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb
SHA3-384 hash:	bb7ccb7d4016b9986017ac3d46c850a3201e00492095bff5662bb5c4870f6ddc8052a023c63ef8826baa29ef597437af
SHA1 hash:	738514e45a8b864071523602b94a94937f73e679
MD5 hash:	cd6f408b3e94c0bb69e7081bad538ee2
humanhash:	yellow-fifteen-five-summer
File name:	CH.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	580'608 bytes
First seen:	2020-07-29 06:30:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'746 x AgentTesla, 19'628 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:5jL93jOb1a2xaLBN6g+b27F1N5R85mxe7+InX:5Hob1ZDkocxa
Threatray	10'713 similar samples on MalwareBazaar
TLSH	2DC4F10521985B1FC75A91B97027C1F01223D4A9EBAAEEB75D8FE09719C22FE34C3257
Reporter	abuse_ch
Tags:	AgentTesla exe HSBC

abuse_ch

Malspam distributing AgentTesla:

HELO: gg0.514.strinoemenker.ml
Sending IP: 139.59.33.79
From: HSBC BANK <noreply@hsbc.co.uk>
Subject: Payment Advice 29/07/2020- Advice Ref:[SWFA81091000] / ACH credits / Customer Ref:[HX185310812321] / Second Party Ref:[08]
Attachment: Payment swift copy.iso (contains "CH.exe")

AgentTesla SMTP exfil server:
smtp.elittacop.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34231/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Using the Windows Management Instrumentation requests

Creating a file

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/401325

Signature

Antivirus / Scanner detection for submitted sample

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb/

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-07-29 06:32:08 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zfmsduh4o5xt7htyyuf5haamc3qtlejd35qkpdy3lkui5ytllnq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

097425f924aa9cd5afeddfe3bf08e512ae2e055f04024781676389eb26a27d4f

AgentTesla

123e454af642e26f82ecd6fec5b7f3e5a04c015dad7c5880b1101d00ba1c804d

AgentTesla

1a5d841876ef1e6ad5a9ff4ff4f8d23687e2e80d62f1386fde805a8653110d98

AgentTesla

1d5c4bc37dad083e9b4f2361e6143c4c35ec666913488af8a75ceee52d48f805

AgentTesla

32d32077aad33fc5c282232207d2503d74ce0a1a0c1bb696d4cfd0b0d5ec5296

AgentTesla

6770ffec040c10ed6a13f0e654e9ac96763d3dd9c0c214ce658aa0648367216a

AgentTesla

814a5dc8dbe791a8e554c6823eedb3b4e9bfcd1006901df2f3468f71d1dd8437

AgentTesla

a050666285b441dd6b72aa1fa6e626f51498acbfd71fbb75d9f3daa4f9802aa9

AgentTesla

e7198a6f6cf52e2f218e8354fbe9d3a59f7154aec99ec74d51017f7f9ff82ba1

AgentTesla

+ 10'703 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

evasion spyware keylogger trojan stealer family:agenttesla

Link:

https://tria.ge/reports/200729-sy2j4f4dqs/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Maps connected drives based on registry

Reads user/profile data of web browsers

Checks BIOS information in registry

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d64ac90e87e3bb79fcf3c6285e9c0060b709ac891efb053c78dad54477135adb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar