MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460
SHA3-384 hash: 52edc95801885597a39caf11e18ebbd94b43e5c66710e103a3c1625281d3703035cd213914bd767b990005c8ccc5f2e6
SHA1 hash: 55ec3db29f152c909ac6b99c40b0178d6f4f0ce6
MD5 hash: 1a9146e0dc61061a51b98c1fb7f14afe
humanhash: lactose-winner-eleven-bakerloo
File name:LindstrmPO45676.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:728'064 bytes
First seen:2020-08-03 13:44:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:Ho4MNsSReyccHtIoAe1ESPBQryFyWnwKgk5IV0TWNgwdOBPfDoUu+:I9Qq1ES6FWwwCHdN
Threatray 2'104 similar samples on MalwareBazaar
TLSH 8CF4CF5C7BE0952AF59A0FBA9C725102AD34F40BA81BE38F39F5126C147A79CAC41F53
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: WIN-0F69EMTSK6Q
Sending IP: 185.222.57.240
From: Lindström inc Gmbh <jeettiwari@cirtindia.com>
Subject: Lindström PO second quarter
Attachment: LindstrmPO45676.exe

AgentTesla SMTP exfil server:
smtp.loudprofesslonal.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37879/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/408018
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 256235 Sample: LindstrmPO45676.exe Startdate: 03/08/2020 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Yara detected AgentTesla 2->55 57 Yara detected AntiVM_3 2->57 59 2 other signatures 2->59 6 LindstrmPO45676.exe 3 2->6         started        10 MyApps.exe 2 2->10         started        12 MyApps.exe 3 2->12         started        process3 file4 23 C:\Users\user\...\LindstrmPO45676.exe.log, ASCII 6->23 dropped 61 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->61 63 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->63 65 Injects a PE file into a foreign processes 6->65 67 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 6->67 14 LindstrmPO45676.exe 2 7 6->14         started        19 MyApps.exe 4 10->19         started        69 Machine Learning detection for dropped file 12->69 21 MyApps.exe 4 12->21         started        signatures5 process6 dnsIp7 29 smtp.loudprofesslonal.com 14->29 31 us2.smtp.mailhostbox.com 208.91.199.225, 25, 49742 PUBLIC-DOMAIN-REGISTRYUS United States 14->31 33 192.168.2.1 unknown unknown 14->33 25 C:\Users\user\AppData\Roaming\...\MyApps.exe, PE32 14->25 dropped 27 C:\Users\user\...\MyApps.exe:Zone.Identifier, ASCII 14->27 dropped 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->39 41 Moves itself to temp directory 14->41 43 Tries to steal Mail credentials (via file access) 14->43 45 Installs a global keyboard hook 14->45 35 smtp.loudprofesslonal.com 19->35 37 208.91.199.223, 25, 49744, 49760 PUBLIC-DOMAIN-REGISTRYUS United States 19->37 47 Tries to harvest and steal ftp login credentials 19->47 49 Tries to harvest and steal browser information (history, passwords, etc) 19->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->51 file8 signatures9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:46:14 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xc4tv2tkevge3l3yttkcqmrwpnxkkinuucgw7knl7kkzqxngrqa._file
Verdict:
malicious
Similar samples:
1b476c8bd4604f9eb16f852bd2a7770520789b8740195c32b30f68dcfc9e91e9
AgentTesla
397430a16d115d42056de1dca482e0fd9290ce8cbe6c45a614cac0fc85983a72
AgentTesla
4f965aee8b694528d2d11d5a80eeee466959650ffcd12b5f0fc28d3a11709e27
AgentTesla
53af62936f7cb4fcbcb2775be40606aed87def8af75821520ebd857dc91370c1
AgentTesla
6eb10ca3e8026756f417b8e04510f768c28175817c73be8f21514dfb186d687f
AgentTesla
6f2ed9ee33724651d7fb52edc4dbb3bfde3c19ca12cf5e990952d392305d1c20
AgentTesla
ab13f3cf7de54784a1fe4cb2957e019ce6c9564c63eb11f42b4ee80762e51179
AgentTesla
c523252072f5911950614d6a91d16036b0128c10458f05a4ab0b7a3221780c1a
AgentTesla
c7ef577b1f4ed52125ba91adb3ae69578179afc6826b08acb7aa10641d8c2e96
AgentTesla
d1d753678c6c2a9e8957c508adc44ccd35c79592a826e973528ec146f33d558c
AgentTesla
+ 2'094 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger stealer spyware trojan family:agenttesla persistence
Link:
https://tria.ge/reports/200803-e5f45czhs6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Reads user/profile data of local email clients
Reads data files stored by FTP clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe e5c5c9d753512a626d7bc4e6a14191b3db75290da5046b7d4d5fd4acc2ed3460

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/37879/

Comments