MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edfcf01c73ca6335d2040ac54b4d1513a4bb1ae7756e2ead34ddb6b03fb044f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edfcf01c73ca6335d2040ac54b4d1513a4bb1ae7756e2ead34ddb6b03fb044f7
SHA3-384 hash: f1ca1c1889b97fa072a77ec158c52c52b18e6b31fb8552fd615399011baa803cae9fe47eb4e2fc801f033bec3cb213f7
SHA1 hash: 3bd49e35a25a31b0851fb6d771d82838454c5747
MD5 hash: 69a85bc007871ea014da3d49ae012501
humanhash: batman-bluebird-lion-stairway
File name:285100727000782928_PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:736'256 bytes
First seen:2020-06-02 10:34:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bea360bfb27d8eea8cfadfbf8d4f992d (8 x AgentTesla, 5 x Loki, 1 x NanoCore)
ssdeep 12288:eP3Ap0AcJKfs3RrAIaNq4uoLGv/fTA9Nx44G+B8VpIupxWW/t9CX:0gKKsmIaznKHfstTG+B8nnnp9q
Threatray 11'927 similar samples on MalwareBazaar
TLSH 60F49F22F2A04833C263167C7D5BB7785C36BF30696869866BE5CD4C6F397813836297
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rcp1.ulimitserver.com
Sending IP: 178.218.166.204
From: Sberbank <izvodi@mail.sberbank.rs>
Subject: Mesečni izvod za kreditnu karticu
Attachment: 285100727000782928_PDF.zip (contains "285100727000782928_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 11:43:49 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5x6pahdtzjrtluqeblcuwtivcoslwgxhovxc5lju3w3lap5qit3q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
01623a798b7efb749c3409651a85050b58327c7dbe59740f79dac9b78ae24c9b
AgentTesla
120d96195361d6479ef060e244d7337939541c59b434d329103627f35d65f697
AgentTesla
33fefd2ae3ff75bcae6718f2abbc99bc7ca047a4543c5420883eb39e1128e9e5
AgentTesla
6b4d7ac31a05055268f04ba4a727a23c12e25892aa8ff5896b28d21ab820aa55
AgentTesla
a9d7b84cfc7fa078466ceade8534942fb80b0acd25ba3f8b848dfc12dc1fae21
AgentTesla
cd4ee674aa9d15d9b3ea4786f008b850340a14db344d5ba7ddddd0ce734fb3fa
AgentTesla
e5d0489c5b615585c49b6389f66c7f9e3694078e7648272db4632affcc5457be
AgentTesla
f02f1aa81359a40dc5654db55fe211c8dff8c88a790d10089fcbca1840a84c3a
AgentTesla
f3232a34ddf3d75e57216467b754d135204fddc84a1755d694aef2c4a3b599e5
AgentTesla
fc849ef113b6dfd401b03e989e2888e30c62af7938347a2bbca04153f5b36249
AgentTesla
+ 11'917 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-ecs42bf6fn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 08d352c216720cf6d9109215c7f806bc69721a0363b7c11b9a8db0a6ef0bd7c6

AgentTesla

Executable exe edfcf01c73ca6335d2040ac54b4d1513a4bb1ae7756e2ead34ddb6b03fb044f7

(this sample)

  
Dropped by
MD5 df9ea2d4eadcef733b6adf759c49c205
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 08d352c216720cf6d9109215c7f806bc69721a0363b7c11b9a8db0a6ef0bd7c6

Comments