MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891
SHA3-384 hash: 8f6c26a2f93dedf53c0630225c885dade75d85943341a81f0c0aca6199842121e87cab3d050aada456d49e3d37bc6da9
SHA1 hash: ab16a46c2175803d66075b3a315ad5e0206db5af
MD5 hash: 201f620a163074676eb00e697efa35c6
humanhash: october-summer-sink-carbon
File name:fortuyne.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'274'368 bytes
First seen:2020-10-19 10:31:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:rAHnh+eWsN3skA4RV1Hom2KXMmHatsJwVZTgCl/e2tP42E1n6K42LKT5:Gh+ZkldoPK8YatsK/TgCl22BEh74b
Threatray 5 similar samples on MalwareBazaar
TLSH 8C45BE0273D2C036FFAB92739B6AF24196BD79254133852F13981DB9BD701B2263D663
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: www.pajufreeschool.org
Sending IP: 103.99.1.108
From: Jim<choa@www.pajufreeschool.org >
Reply-To: Jim<info@yklsteel.com >
Subject: AW:Packinglist
Attachment: INVOICE.IMG (contains "fortuyne.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/72891/
Detection(s):
SecuriteInfo.com.AutoIT-3.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.EmbeddedEXE-5.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file
Launching a process
Using the Windows Management Instrumentation requests
Forced shutdown of a system process
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/495249
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 06:30:13 UTC
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5aq4voyeefigyiidfvfo7hnwk4s4jlv3xrq7ghna2juzg74r5ciq._file
Verdict:
unknown
Similar samples:
48d22944fdf7cf66fd1423b6ab2dd0143d96b4db7915e088088b8f826d46b000
AgentTesla
b3db12ee110a51adbbbe9901d5c5ad135aae575a37a8f2a5632b88eedacede6a
AgentTesla
b559b57a32b925a016e954b9d499baccd9c629ab3218858a9019e276b0831c4d
AgentTesla
bd752c46af3d020a57a29458209f135518890abdcac5934b754a8fddf20435cb
AgentTesla
f8ead6b4249948dc3a300ba676acbdf6cb85ef6aef32d6bea64e9b6eb5a75f73
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
spyware keylogger trojan stealer family:agenttesla
Link:
https://tria.ge/reports/201019-vsewjpvbns/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
55fc3c2bbe8fcf87d350386b62d5957aa470d0e65ba5eba81ec80f5b94425684
MD5 hash:
af9156dc61f62358c37b805da665eb12
SHA1 hash:
16e01fb4737d8b9c214bfe5b1ec97738dea815c9
Link:
https://www.unpac.me/results/1a515ac9-84c8-4fbb-8ae7-064cc499bdff/
SH256 hash:
e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891
MD5 hash:
201f620a163074676eb00e697efa35c6
SHA1 hash:
ab16a46c2175803d66075b3a315ad5e0206db5af
Link:
https://www.unpac.me/results/1a515ac9-84c8-4fbb-8ae7-064cc499bdff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img d66743c03fd67e12b2fa4519d9312ff0133c0b0197e3a522d258dcb78e3a3e53

AgentTesla

Executable exe e821cabb0421506c21032d4aef9db65725c4aebbbc61f31da0d269937f91e891

(this sample)

  
Dropped by
MD5 a11fde9fd38210c3d2484563bdccd577
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72891/
  
Dropped by
SHA256 d66743c03fd67e12b2fa4519d9312ff0133c0b0197e3a522d258dcb78e3a3e53

Comments