MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc241ba360d33151f9653cfc416e88c6637d91c097406965809860a5317b76e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	dc241ba360d33151f9653cfc416e88c6637d91c097406965809860a5317b76e6
SHA3-384 hash:	9cf7da31873464c2906ba32338575c35522793468503a3241829fb7b8535a21a17894db670b25b2e34006451d85cae7f
SHA1 hash:	034cb29e45a08f59a640c3c4ae9897ff30546dd2
MD5 hash:	36e1d80a3af52ebf3f1de870582e0c31
humanhash:	moon-eleven-mountain-april
File name:	Transfer Request_pdf.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	729'600 bytes
First seen:	2020-11-09 15:33:13 UTC
Last seen:	2020-11-15 23:08:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:vt8Dld+fmcNcIqHyA5qDBogGuZjy9mN2jm7ILv6R1Oc85:v7cL57gG6Exjmke98
Threatray	10'852 similar samples on MalwareBazaar
TLSH	0FF4D01227E97F91E13EA7799425200187F1BA1BE732C7C9BECD11D90B63F844B62B16
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: trentslaney.servers.prgn.misp.co.uk
Sending IP: 185.119.174.12
From: Mohammed Dawsar Trabulsi <tdp@cyber.net.pk>
Subject: PAYMENT INSTRUCTION !!
Attachment: Transfer Request_pdf.gz (contains "Transfer Request_pdf.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.Smdd-6956905-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Creating a file

Using the Windows Management Instrumentation requests

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/526590

Signature

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc241ba360d33151f9653cfc416e88c6637d91c097406965809860a5317b76e6/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-11-09 08:30:31 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3qsbxi3a2myvd6lfht6ec3uiyzrx3eoas5agszmatbqkkml3o3ta._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

30a0f8b6dc30fb3a9e649149d9e92f39b50b4d9c595f9d5c4400c62caad0b7b4

AgentTesla

41f6638f1e6ad1d8aee7d3d0ccd9a39af59e340b2ad2074d25d72dc8556855d6

AgentTesla

4b2ba5e0907fa5c1cbfd980bee03483ccce1d11bdcf924e90de7a7c72ded2ef9

AgentTesla

4d48fc6432fbd06c737a526da3f6c074caf45514c2bb1f1c8a3f7d5a5d37436b

AgentTesla

b05d95907bad3746cc161aa8bd74c71191a25fc383557fbf754d7c417daeb8f4

AgentTesla

b5bc74bcee96164cc5419a48594d9aade1ebc15c2dd2544e9caa68c4fc715ed1

AgentTesla

bd88e8167365b27258a2b75475627f6f338c4911a3cb1d3b1150dd44bbd70aa3

AgentTesla

c18c5e02d67ca2dea08e13f3731c5dd0f5d8833bf2b606287c97e1d053564b85

AgentTesla

c62984587e756c3238bf4694ed959c509341427c9f06fc4973c0e7f6fb614546

AgentTesla

+ 10'842 additional samples on MalwareBazaar

Result

Malware family:

agenttesla

Score:

10/10

Tags:

family:agenttesla keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-c1j47g6c4n/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Reads user/profile data of local email clients

Reads user/profile data of web browsers

AgentTesla Payload

AgentTesla

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dc241ba360d33151f9653cfc416e88c6637d91c097406965809860a5317b76e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla_extracted_bin Create hunting rule
Author:	James_inthe_box
Description:	AgentTesla extracted

Rule name:	AgentTesla_mod_tough_bin Create hunting rule
Author:	James_inthe_box
Reference:	https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	agent_tesla_2019 Create hunting rule
Author:	jeFF0Falltrades

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar