MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef0c2ed8513696cd7e1906a3d0e4ec4756078edcf1d0682d23e9f945d178f3dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef0c2ed8513696cd7e1906a3d0e4ec4756078edcf1d0682d23e9f945d178f3dd
SHA3-384 hash: b2abb32abb79812d2d037db93cad107ca57e87a0cf6a7b9e21232d4d9e79907224ad9a15895ea9c41fc1b4b3cf8e37a2
SHA1 hash: e98c2cd944ea97227bd61077d662345bf7d4ba29
MD5 hash: 9ef8088b09c94b172abf997a30c4d97a
humanhash: cold-high-island-washington
File name:CARTA DEL BANCO DE REMESAS.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:820'224 bytes
First seen:2020-10-21 07:02:31 UTC
Last seen:2020-10-25 19:49:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 24576:IfyNIl4UyCHDJCHDxgdXLlSiP51Y1A1GUKzod:AEGbyCHV8RO1Y1ANKzo
Threatray 683 similar samples on MalwareBazaar
TLSH 13059D98329075AFC65BCD728A681C14EA213C77531BD207902336AD9A3DADBDF146F3
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: siddheshwarsugars.com
Sending IP: 37.48.85.226
From: Khaldoun Mattar <electrical@siddheshwarsugars.com>
Subject: CARTA DEL BANCO DE REMESAS
Attachment: CARTA DEL BANCO DE REMESAS.arj (contains "CARTA DEL BANCO DE REMESAS.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.25.31963.18739.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/505334
Signature
Binary contains a suspicious time stamp
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Moves itself to temp directory
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 301695 Sample: CARTA DEL BANCO DE REMESAS.exe Startdate: 21/10/2020 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 10 other signatures 2->53 7 CARTA DEL BANCO DE REMESAS.exe 6 2->7         started        10 YYtJku.exe 5 2->10         started        14 YYtJku.exe 2->14         started        process3 dnsIp4 37 C:\Users\user\AppData\...\SJxuNEEcEZK.exe, PE32 7->37 dropped 39 C:\Users\user\AppData\Local\...\tmp3AC0.tmp, XML 7->39 dropped 41 C:\...\CARTA DEL BANCO DE REMESAS.exe.log, ASCII 7->41 dropped 16 CARTA DEL BANCO DE REMESAS.exe 2 5 7->16         started        21 schtasks.exe 1 7->21         started        45 192.168.2.1 unknown unknown 10->45 63 Multi AV Scanner detection for dropped file 10->63 65 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 10->65 67 Machine Learning detection for dropped file 10->67 69 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->69 23 schtasks.exe 1 10->23         started        25 YYtJku.exe 2 10->25         started        27 YYtJku.exe 10->27         started        file5 signatures6 process7 dnsIp8 43 us2.smtp.mailhostbox.com 208.91.199.224, 49733, 587 PUBLIC-DOMAIN-REGISTRYUS United States 16->43 33 C:\Users\user\AppData\Roaming\...\YYtJku.exe, PE32 16->33 dropped 35 C:\Users\user\...\YYtJku.exe:Zone.Identifier, ASCII 16->35 dropped 55 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 16->55 57 Moves itself to temp directory 16->57 59 Tries to steal Mail credentials (via file access) 16->59 61 3 other signatures 16->61 29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        file9 signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef0c2ed8513696cd7e1906a3d0e4ec4756078edcf1d0682d23e9f945d178f3dd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 16:38:36 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54gc5wcrg2lm27qza2r5bzhmi5lapdw46higqljd5h4ululy6poq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
026b38e8eb0e4f505dc5601246143e7e77bbd2630b91df50622e7a14e0728675
AgentTesla
19cb1d89fb670dd31ceae6e0c41ffcf47767f6b3779804841f7aaf75adcd028f
AgentTesla
295cd8c1062fecbaf17dd0095897fbdca561bf28616a08190a47adfb68e7c10d
AgentTesla
33173729b4041cb76f237254201f440babcde775bfa912329d0ebe4b5b8a97e2
AgentTesla
3fdeeff9063421be07d09d4e1af9d7051e036ca556749cd82aaf6335593f7dc9
AgentTesla
90c99275bfea4f4084d07b4a0a044f81e6c9fbe19fba688a7fe8a0be46004acf
AgentTesla
955b975ba713a4027be44b9b6b35b0cebe27439c71d09309992a89b6185cf4d5
AgentTesla
ba5cf0e14767afbaf1ef4310a5a7a55e152b7c54507a1b567133cdf42493629d
AgentTesla
c2ba3a95fddac0ef23badcc972a977cb385c87946ae87816ccdc76358b7183e6
AgentTesla
e63d9fff34fc1c54b4e9bcb779e8101ca5e65f84d84e153c0788dec7d8ee5d42
AgentTesla
+ 673 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201021-ghff6vl92a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
31ce938626ccfb399fe1696710caf46d7ae9eb598b9d7d2aad719b594658469b
MD5 hash:
0aebe46040ceb011e78506d4985fe3de
SHA1 hash:
218ac1e7b14a66c604ec3042f8486bed9cd4c2c1
Link:
https://www.unpac.me/results/e8dc9c9b-e027-4b1d-a2f0-81e4fd825bfd/
SH256 hash:
2bc7a74861af38d70bfbb110156fa979ff0e7716c62b482520c271f81c1948a9
MD5 hash:
ef39e66bf1bc997b30db15d248253cbc
SHA1 hash:
ceebe1a57be3cbd4d16950dc46a569248ca14aae
Link:
https://www.unpac.me/results/e8dc9c9b-e027-4b1d-a2f0-81e4fd825bfd/
SH256 hash:
45f5eedf54db0e733d41240cb1a1df67008eda0ddbbe22e4f14c60f65dd3eb56
MD5 hash:
0eefd3c5290f9eb63913e70d8104fce9
SHA1 hash:
de6c74cd49344562ec836995019e342a9fb49ad0
Link:
https://www.unpac.me/results/e8dc9c9b-e027-4b1d-a2f0-81e4fd825bfd/
SH256 hash:
ef0c2ed8513696cd7e1906a3d0e4ec4756078edcf1d0682d23e9f945d178f3dd
MD5 hash:
9ef8088b09c94b172abf997a30c4d97a
SHA1 hash:
e98c2cd944ea97227bd61077d662345bf7d4ba29
Link:
https://www.unpac.me/results/e8dc9c9b-e027-4b1d-a2f0-81e4fd825bfd/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 49ed7b4b2ffff8473d6710ba0deae1114a8f2d48279693d5ca96461e491c02e5

AgentTesla

Executable exe ef0c2ed8513696cd7e1906a3d0e4ec4756078edcf1d0682d23e9f945d178f3dd

(this sample)

  
Dropped by
MD5 a941c5960c392c9681aa7af5f85ca752
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/73866/
  
Dropped by
SHA256 49ed7b4b2ffff8473d6710ba0deae1114a8f2d48279693d5ca96461e491c02e5

Comments