MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf
SHA3-384 hash:	13f0682cc2983a9dcb35ca8f98bfb3c355e25fb9ace35cacc83e8c43a76a1e11bb30adac56f7c3d094817632a64e868e
SHA1 hash:	e8635b77f7a7d2c0b8358d534ac4aaa069d7cef7
MD5 hash:	584fec93c4d3af107c1b364f5090de14
humanhash:	jersey-emma-lima-lactose
File name:	Offer.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'620'992 bytes
First seen:	2021-01-18 08:00:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'453 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	24576:kXe7qaadp6dJxcwpvdhy114o8Da5Rgag7rcFILNg+94KYvsGijSeJm:kXnRSdJxdpvwShmRgY4fuKYCnJ
Threatray	2'170 similar samples on MalwareBazaar
TLSH	07755A583394B39ECA9BC8B6DD541C60FA50B467930BE213F06F21D99F0D89ACF4A5E1
Reporter	abuse_ch
Tags:	AgentTesla exe Telegram

abuse_ch

Malspam distributing unidentified malware:

HELO: frf-ajf.ro
Sending IP: 89.45.174.241
From: CLUB ATLETICO <mark.laurel@tutanota.de>
Subject: RE: OFFER OF PLAYER
Attachment: Offer.zip (contains "Offer.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Offer.exe

Verdict:

No threats detected

Analysis date:

2021-01-18 08:14:47 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/159745bd-c756-4fd2-a6e4-b663083b9b31

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AgentTeslaV3

Link:

https://www.capesandbox.com/analysis/112438/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

AgentTesla

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/583755

Signature

.NET source code contains very large array initializations

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AgentTesla

Yara detected AntiVM_3

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-01-18 05:48:19 UTC

AV detection:

5 of 44 (11.36%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3526ax6pfsstvolktcniacztk5f76de5j2axdyv2vkwzgwfjcs7q._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

5d341e97346284948f292b2acef3b6a2b48f2e1b106732aeac5046723d5ec39e

AgentTesla

69b3daa0773330e2607a293d7e268f6360c74f1a446a803944a00c8cd5162527

AgentTesla

6e1a37cc8b4d9d0588132c3f315a4e1f7873ddae440c7be61381b12edf74e723

AgentTesla

84afce79b516a2535b4f063e9dd9aef84aa6288bdc65c4fa5dbbba0bc06727ec

AgentTesla

9efe8cef3127a10a3c0ee380a77298650e7a54e9e785d86f9871c00c2ad62bdf

AgentTesla

f4663339e09f575301700439ee6afbba8b6193a789fd5bb5bf96a966f746a7d6

AgentTesla

fa816fa2565bb49b65dbb51bb3a70f87b82437e19c0e7680a6a112fe177f880b

AgentTesla

fdde861930d90cd01ecd816cbd4c0167757ea3068b4a67edd28b7b9514fdc1a2

AgentTesla

fdfccd2b06ff7ace13bd64a1d1035f62dc5c81e303f0e96733680713b2b4294f

AgentTesla

+ 2'160 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/210118-jfd2lwdhk6/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Unpacked files

SH256 hash:

1d6ecf546163882d34d4bb2b7afa3889506ca3036ed536c4ed972ed89bdf5035

MD5 hash:

fb169513679d349cb2a7e4121bacfd4a

SHA1 hash:

26619d7ce0a175b9fc4fbfd7f4b105050562924f

Link:

https://www.unpac.me/results/6617144a-18fe-4d16-b3bb-a5c8dc255c02/

SH256 hash:

df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf

MD5 hash:

584fec93c4d3af107c1b364f5090de14

SHA1 hash:

e8635b77f7a7d2c0b8358d534ac4aaa069d7cef7

Link:

https://www.unpac.me/results/6617144a-18fe-4d16-b3bb-a5c8dc255c02/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.