MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f23a280b7303eaf61fc3f6650dd4f879d80250d2db7051ed569f5270dbc4c22e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f23a280b7303eaf61fc3f6650dd4f879d80250d2db7051ed569f5270dbc4c22e
SHA3-384 hash: b9a43ae6a1758a6539e58acd277a457318f09fe58fc943dc2c230a70e43203fd6369010c72ca83b2fe2c223bde36069b
SHA1 hash: dc738ae54066e65f59b70a0fa4fcacee66c3073e
MD5 hash: c4b7a8b9a63036cd740b66072f8b600c
humanhash: may-blossom-freddie-blue
File name:PO # 454214 & 454215.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:453'663 bytes
First seen:2020-04-27 23:10:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7eae418c7423834ffc3d79b4300bd6fb (51 x GuLoader, 16 x RemcosRAT, 15 x AgentTesla)
ssdeep 12288:wHdvWWegr4Ki/56rbYqqjxxv9N6qbDUWCR1QYW+CKEmX:Qd1ni/56vjOxLoFno6J
Threatray 10'777 similar samples on MalwareBazaar
TLSH 5FA413E1E2A140A7D85757305A3FFF253637AE3F24A42A039B51BE1D29336839939707
Reporter c_APT_ure
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Makoob-7546093-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EKCH.14211.11984.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-01-14 14:34:08 UTC
File Type:
PE (Exe)
Extracted files:
71
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
avemaria
Create hunting rule
emotet
Create hunting rule
Similar samples:
1b4edda8f293ac8fba3e2bc1bf84406f61213e1f91f369f344cfcf755867ec6e
AgentTesla
1dca04a092036da431753ed714b8e11bbd6ed1db8c9b3755d05bb8c61fcfc805
AgentTesla
57df36fc7452bb8ef66e18f5ca34deace335039f1ffe1119c975b547a788377e
AgentTesla
7a89bde0a6c3c23a3eb3b6e44f0ea164a30f8fe80f07cd5e016006dae718acc2
AgentTesla
7ab3cbcd225fda209a34c512ef956131c4430d84b7836b925739701686a24630
AgentTesla
7f739c5eac76d496c71d9a0b24abe3d9990adb95321a1145eff1f3e68e3c4745
AgentTesla
8be1266645d388fa35124c58831cbd83fdc9b6faac7ad44ddaf4b0f6b9d2fd09
AgentTesla
b283242e8ae83c1b2136090df9d70d06e328ee7116186667ed766d87f468da93
AgentTesla
dafdcd9e9b75c4d7187fcfb384788bf5925a1a3426eb7e6d3cc2147b5e9bdc66
AgentTesla
e6f2d277d61fd27d2a6452619111c272047ff478247251c9ec5651f5f67e1519
AgentTesla
+ 10'767 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments