MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099
SHA3-384 hash: db2e787c0a32b3d77f4cfa6801d6baab55dcfcf89419971ad30ab5b9d7466bd4fedd78c3c85b964649ab1c3add3cfa2d
SHA1 hash: 44bb9a0f0fe41c2ccec343a2bce3726a06c415b9
MD5 hash: 29d24cacca4024af741697812b5c6fb7
humanhash: yellow-michigan-monkey-ink
File name:Re AMC Payment transferred Rs2,03,550.00.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:720'384 bytes
First seen:2020-10-07 12:13:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:s4Da0lFmP8PdZRpeDSu7t7XkDqyp/4cwoHK2zVibeqB:ssa0lF+8PeDvQR7t5ib
Threatray 853 similar samples on MalwareBazaar
TLSH EDE4F1243A95FF4EC60A8F3B44160C20E7E0E5765657F387ACE719ED980E79D4A312E2
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server50.a2zcreatorz.com
Sending IP: 69.16.232.53
From: mariac <mariac.castro@soneyfashion.com>
Reply-To: mariac.castro@soneyfashion.com
Subject: Re: AMC Payment transferred Rs:2,03,550.00
Attachment: Re AMC Payment transferred Rs2,03,550.00.zip (contains "Re AMC Payment transferred Rs2,03,550.00.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68921/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/484098
Signature
Binary contains a suspicious time stamp
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 294493 Sample: Re AMC Payment transferred ... Startdate: 07/10/2020 Architecture: WINDOWS Score: 100 41 Multi AV Scanner detection for dropped file 2->41 43 Sigma detected: Scheduled temp file as task from temp location 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 11 other signatures 2->47 7 Re AMC Payment transferred Rs2,03,550.00.exe 1 7 2->7         started        process3 file4 33 C:\Users\user\AppData\...\AgiKEdDKjhnfLt.exe, PE32 7->33 dropped 35 C:\...\AgiKEdDKjhnfLt.exe:Zone.Identifier, ASCII 7->35 dropped 37 C:\Users\user\AppData\Local\...\tmpE0F4.tmp, XML 7->37 dropped 39 Re AMC Payment tra...2,03,550.00.exe.log, ASCII 7->39 dropped 49 Injects a PE file into a foreign processes 7->49 11 powershell.exe 22 7->11         started        13 powershell.exe 25 7->13         started        15 powershell.exe 1 7->15         started        17 12 other processes 7->17 signatures5 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 17->27         started        29 conhost.exe 17->29         started        31 8 other processes 17->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 11:52:42 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7f2pmwbzpmt3xrl2pcdtz67l4v5i74tuf7e3rpckng6gontckcmq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06a10d502aec711bf0ffff177e2020fe0c3a94cb61119ea7ba320de6cbabebb3
AgentTesla
17b671d207ca3e6334ddcae8ce17f1317ccaf35e992fed85724313ee1919f519
AgentTesla
2fe5ca185c663e5d06d0ade1a4e0f5d9c0994239102a5a1725aa7e25edbbf5fe
AgentTesla
3d28762fd17d3315647ac901942b234cbacca781014965398a2079ccc6766337
AgentTesla
4a4f7d774032e80c392ff7fe598a05736cf4f71dc0dcf5616ce980f9cbb598ae
AgentTesla
5b48475bbc32e2dbd6ebfb746071c6192e57dfdfcfc0cfb1ae9f381663728537
AgentTesla
96bb500afd48645a966af87ba319dc72388964f84726552f72f31c936c7628b2
AgentTesla
a0062b106277324b51718baac12082f12f735f370173fa3073abf70b86b016be
AgentTesla
baad571b7bebeb2d292fdff866400947877d8531a7bcbee73635660d73d8cc86
AgentTesla
cc87cc3cff16721cb3f7e6be1e5be62bcdacafd1fa70ec879c6a9c12a9b438bb
AgentTesla
+ 843 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201007-5pgw6k2jkj/
Unpacked files
SH256 hash:
f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099
MD5 hash:
29d24cacca4024af741697812b5c6fb7
SHA1 hash:
44bb9a0f0fe41c2ccec343a2bce3726a06c415b9
Link:
https://www.unpac.me/results/12af300a-d885-4e5f-9c0c-7788ee7fe960/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/12af300a-d885-4e5f-9c0c-7788ee7fe960/
SH256 hash:
998e449cf76251c9506943d0eb0c4be8ea8539136268253add1adae4eac554d5
MD5 hash:
506d751290ae8eff4e788a6a354e447e
SHA1 hash:
839a6dd379157f262323ccd97ad120d102a85d58
Link:
https://www.unpac.me/results/12af300a-d885-4e5f-9c0c-7788ee7fe960/
SH256 hash:
5054a12deb4f656544cb663b195f66cc5633ae067f5e16089f07263b44c547b4
MD5 hash:
01437a3d9ef199fe467a58bbc1d5fd64
SHA1 hash:
a3b2e46a1dce37a6acd692db12610b09c5a46987
Link:
https://www.unpac.me/results/12af300a-d885-4e5f-9c0c-7788ee7fe960/
SH256 hash:
cd6a1e71998821ffeff87714d7498b51a8f5dc6a343fc8a96ab1853996fd7fd2
MD5 hash:
f7030cd904fc0d722da9c9e7e7c7bbde
SHA1 hash:
f923b42ca3e626981898c5f8ff42b9593691bc8e
Link:
https://www.unpac.me/results/12af300a-d885-4e5f-9c0c-7788ee7fe960/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099

File information

The table below shows additional information about this malware sample such as delivery method and external references.

e42f5f9cc7e4a7b021f96c235113acc1

AgentTesla

Executable exe f974f658397b27bbc57a78873cfbebe57a8ff2742fc9b8bc4a69bc6736625099

(this sample)

  
Dropped by
MD5 e42f5f9cc7e4a7b021f96c235113acc1
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68921/

Comments