MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d
SHA3-384 hash: 01f1234db58264db5f5c3cb57f6e6e22181c8c4db60988be31a34880775e377901c41bfae53a85c8d6c60b87225c96ea
SHA1 hash: 1d8fdd7eb1c87fb8b04bd1e3384f5d27e46ba307
MD5 hash: e1b0c67785b827e7d33c6150dbd2f199
humanhash: delta-mike-edward-cardinal
File name:CI, PL & Draft BL.scr
Download: download sample
Signature AgentTesla
File size:561'152 bytes
First seen:2020-06-30 12:01:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 6144:/7C8ixqtYSZWuk0EbNGxoJVyYGeEq+68H/1/8k2aMrFiLTZq2dntL2m3/:/7C8ixIYes0EbAg4YGeXA8kAoBRF
TLSH E7C47933613DC6E6F9AC7EB5265547240EB16D871230E11BEA5FBCC5E8B3623C214AD2
Reporter @abuse_ch
Tags:AgentTesla Maersk scr


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: balaitus.efor.es
Sending IP: 93.92.232.247
From: MAERSK Shipping<oficina@coduras.com>
Reply-To: <jp.intl444@gmail.com>
Subject: Maersk Notification_Shipment /FCL/LCL/Delivery Report, CI, PL & Draft B/L WS-FP/16-201--20/40
Attachment: CI+PL+ Draft BLxls.gz (contains "CI, PL & Draft BL.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 26
Origin country US US
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17093/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Androm
First seen:2020-06-30 12:03:04 UTC
AV detection:24 of 31 (77.42%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-bbdtdjj876/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 19.44%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

66dd38c93b758b9dbc88d9b535a7e2b1

AgentTesla

Executable exe dd094a53acb45fb8c7ad5b00763b86703e63a2c1382a0711405a3b8aab68753d

(this sample)

  
Dropped by
MD5 66dd38c93b758b9dbc88d9b535a7e2b1
  
Delivery method
Distributed via e-mail attachment

Comments