MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41
SHA3-384 hash:	5dbc4bb66b35f03dbb765fdcb638c52e3791819dd717e7e274364b24766d5848783cd22e4f3f308c6c2865fe00e926a1
SHA1 hash:	4e990d2673b6617e0be6921b7ea63496b8733f5c
MD5 hash:	276c7ab04e29160803bfc5b16fc58c72
humanhash:	eight-dakota-coffee-potato
File name:	DHL_AWB_INV_9882900_99862788_998.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	738'816 bytes
First seen:	2020-07-21 16:18:26 UTC
Last seen:	2020-07-21 20:00:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep	12288:gfQTPzU4LnsSUAEQ9ugvW9SdlGqgn2Z3h9UMgJJM5FdyyqY1:1U4Ts9/+WOGhQDUMgJJMXES
Threatray	10'342 similar samples on MalwareBazaar
TLSH	C9F49E00FBF4C9CAD36A1F7AD47141008A75F95AABE6E78B2B84F2AD18573584743F12
Reporter	abuse_ch
Tags:	AgentTesla DHL exe

abuse_ch

Malspam distributing AgentTesla:

HELO: racknerd-9a2f07.localdomain
Sending IP: 173.82.90.106
From: DHL | Express Shipping <dhlexpress.billingid@dhl.com>
Subject: Urgent: Shipping Documents (Reminder)
Attachment: DHL_AWB_INV_9882900_99862788_998.img (contains "DHL_AWB_INV_9882900_99862788_998.exe")

AgentTesla SMTP exfil server:
smtp.tpts4seed.net:25

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AgentTeslaV2

Link:

https://www.capesandbox.com/analysis/30288/

Detection(s):

SecuriteInfo.com.generic.ml.4011.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/393515

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41/

Threat name:

ByteCode-MSIL.Trojan.MassLogger

Status:

Malicious

First seen:

2020-07-21 15:33:18 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=274uvpbcf2oxfu4hr3ux2pbfpb4oojf5xa7a5kpjf7bafwmsxzaq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

380e7e3441bb952722dded5a8d87c79257ed78dff7d6f9bcab307428b4200578

AgentTesla

51031d05083e587fa113208a5de4c7f7c0bd4f6ee385bdfee92c63786f7d7e88

AgentTesla

63df2602ff2676e438e25c4544562736eb3c4da856280600d7790edcd0478914

AgentTesla

7d50f85be9ba623c39990f888b9d1d43ac5fa8c317529a3256f4c79d48a626c7

AgentTesla

af8343cc25fb243e378897bcf5c22ff94287610ae86538862feb362e2382b456

AgentTesla

cb72b73a404d3558ab932a260d7417ca25f4f35327a9407b446ad370ff9a5e1e

AgentTesla

cfdbaad170a7847c77fedbe9535a37a6d1107259c8e80f2c7e04a6b2895e86e9

AgentTesla

eed899d24d21a18eedea77f8f2860b70aa843e3f3757e8c53105f6eadd655d41

AgentTesla

f94fdbaf430c51b2d97e75c378a7e6cf66fbbe6984cc9348b9369a435fdaa2b1

AgentTesla

+ 10'332 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/200721-35jqd5kl7n/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Program crash

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d7f94abc222e9d72d3878ee97d3c257878e724bdb83e0ea9e92fc202d992be41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar