MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f782488d6cffc08636ce326d9ab116f99c7abb7a6ced4391f9341e709144d100. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f782488d6cffc08636ce326d9ab116f99c7abb7a6ced4391f9341e709144d100
SHA3-384 hash: 389a73f05b255b33373c66e3da829d94803d607f2b018cf393a4993b44d1ada2d829d0b4f1624f2aa92bc8c920a13bd7
SHA1 hash: d4d3ed132d4bf6782ab4b48a9020e5427133850f
MD5 hash: 355d59a43d4f1a80187564d0c9145ad9
humanhash: ink-india-lactose-oregon
File name:bảng báo giá.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:563'200 bytes
First seen:2020-07-09 07:37:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:WwBrIufstR4mqev0AYM0+FIp1K2LXbX1RYUv7UxHTJlyn4QUtJmaOTpTmDulCmhy:BrFOv/KfFRYOUdJlzJmacTaulCSRO6HY
Threatray 11'284 similar samples on MalwareBazaar
TLSH F3C402BB72941D3BFA3804F6086264444FF76CDB15DDE2ED4C8720DA59E6FC06A406AB
Reporter abuse_ch
Tags:AgentTesla exe geo VNM


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fre.freespirittours.ge
Sending IP: 192.254.140.61
From: Bùi Đăng Giang <danggiang@quochuy.com>
Subject: bảng báo giá
Attachment: bảng báo giá.zip (contains "bảng báo giá.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23506/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f782488d6cffc08636ce326d9ab116f99c7abb7a6ced4391f9341e709144d100/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 07:39:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66berdlm77aimnwogjwzvmiw7gohvo32ntwuhepzgqphbeke2eaa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
14bc7146562bb679d9e708f1f748512a140a4a32e2ae1d7a8de6c971b5639686
AgentTesla
3b6fde65cc308f5f546273a418fa9a710a41250d8bdc9419504dddeeaee04e1d
AgentTesla
66b15ee82b31364bbb038c7a2f60fac0057d01b0865b2b71a4418293fc9e056d
AgentTesla
68f9789527e83e614dc50e0279316745c15b43c7f72f8e7c5d4b99d8a656ff12
AgentTesla
86b9cc599fa4d284440a59cfce0e71521562d221f87d2408925482f42d96861d
AgentTesla
8e6958bbae022603caa738afd463ce24c8b5d39776932dbc847eae282d248f7e
AgentTesla
9d3c04431db8d2630361ac69def49189101a5bf017627be2f147bcd66f3c8d29
AgentTesla
bf9a8a5a9daaf6b026a193e759bf42d4f0b79431db5125263c356a5c1168b523
AgentTesla
c01753dd68c42bc2c0378b93891b424d671cfc6a58a8726e40fa9675122ea028
AgentTesla
fd26229099bd979d8cedf9b694ea9417a0b82dda9f17b218a1dd445015c47277
AgentTesla
+ 11'274 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200709-t15pj3tysn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

0360a75207cd218ea3acaffbd2dfae71

AgentTesla

Executable exe f782488d6cffc08636ce326d9ab116f99c7abb7a6ced4391f9341e709144d100

(this sample)

  
Dropped by
MD5 0360a75207cd218ea3acaffbd2dfae71
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/23506/

Comments