MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22
SHA3-384 hash: 9a3bccff7ba286413535839ffff4a5dd4b83020d1179db7f185d96251194010dee80a886890f102667ff365e1cb9bec1
SHA1 hash: f5ea4355675f4a4d0358aa6c3c997fd96e7f635c
MD5 hash: 4cf21eb60d36bf3e3afd5eaefb6f2fc8
humanhash: double-jig-december-fix
File name:Seashore Group Order.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'544 bytes
First seen:2020-12-09 11:01:21 UTC
Last seen:2020-12-09 13:02:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 553802f9e2099976b11882b89029573d (3 x AgentTesla, 1 x MassLogger, 1 x Loki)
ssdeep 6144:V3QxRP2N/3n3AiFSoMmRqJEdUIqmw0YIIKzxXKaKH/bZl5H4j/4COZ:mxRg3QUlMaqJCqPHIIQGfbZPM/4n
Threatray 1'827 similar samples on MalwareBazaar
TLSH A794F101B9E95030D1B753774568AA620BBEFC755E268EDF2BD85D4C4B380C0BB29B63
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: interia.pl
Sending IP: 213.227.155.6
From: b.mleczko@interia.pl
Subject: Seashore Group Order
Attachment: Seashore Group Order.zip (contains "Seashore Group Order.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Seashore Group Order.exe
Verdict:
Malicious activity
Analysis date:
2020-12-09 11:46:35 UTC
Tags:
rat agenttesla
Link:
https://app.any.run/tasks/501e3235-ec10-44ac-b831-9781c1157394

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/107449/
Detection(s):
SecuriteInfo.com.Artemis4CF21EB60D36.27535.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Searching for the window
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Result
Gathering data
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/558915
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 11:02:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6o5cw6yxwzm5ihthstoav2xaloy5h5osdwwrbvigjyspqw66pmra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f077fb618914c9f987dc7975a5e4c6372234ca35c292de29d864c494910928c
AgentTesla
2a24e55affebdf336e67fe9ba8f667b095784a6bc6857ce8b89e7c48c8a8fd21
AgentTesla
7c49ac4366eb07c5e5a146356908ba9e2e7e1bb2630422821f93530f0e2ec2ed
AgentTesla
84afce79b516a2535b4f063e9dd9aef84aa6288bdc65c4fa5dbbba0bc06727ec
AgentTesla
c04d9dda88a75f4ed924e20617847a4d7a8ff729754e8ad66f3557fb90ed5d25
AgentTesla
ce431d943b7df67690c0c89d1556a8d9ca222a78568d56c8c3aeaccc74f40fd4
AgentTesla
f104dda9f5fb6e0f5659843ce1698c2da434fe2cd9e986a4cd410c0473ca6cf6
AgentTesla
f5a368e8e1fd840abbe075db0a30756ca6297af3c9d3a8f9e1998f57e1204cbd
AgentTesla
f86ae16804864eba0e062dd196a0b46689854fd71b966a5f5ee1621516806379
AgentTesla
ff30ebf52489bc096912d3d89259f8f6e44ec3ced1d124094d10f2fbfaa18590
AgentTesla
+ 1'817 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/201209-51y8ayy7se/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
bffb93d152a159cf240ff572c854f33809cdfbdd55e1238a81add006d55f3363
MD5 hash:
57ca67b1f43493941e44f10579263602
SHA1 hash:
94fc7a9402629942aff9d6044397940c5e3489db
Link:
https://www.unpac.me/results/7f803aff-f58c-4ae3-963e-d2fd9151d94b/
SH256 hash:
cdfe5fb286fd2ee4480d7c0e26af919362d0e506def094d287f57666cb66d62a
MD5 hash:
7b609344bdc821cfb4ef75ee226469da
SHA1 hash:
981b9f0e65da7e7597e5323d9f5ac55a9d9d66f3
Link:
https://www.unpac.me/results/7f803aff-f58c-4ae3-963e-d2fd9151d94b/
SH256 hash:
f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22
MD5 hash:
4cf21eb60d36bf3e3afd5eaefb6f2fc8
SHA1 hash:
f5ea4355675f4a4d0358aa6c3c997fd96e7f635c
Link:
https://www.unpac.me/results/7f803aff-f58c-4ae3-963e-d2fd9151d94b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 24c6497403147b55bdbb2d9da0250becb98b740598fc8afe35e8837ecf8f4c06

AgentTesla

Executable exe f3ba2b7b17b659d41e6794dc0aeae05bb1d3f5d21dad10d5064e24f85bde7b22

(this sample)

  
Dropped by
MD5 0fca004336e9ef5a1912b14ed469ac03
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/107449/
  
Dropped by
SHA256 24c6497403147b55bdbb2d9da0250becb98b740598fc8afe35e8837ecf8f4c06

Comments