MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcdc7b634a27a20fb619cc83b34c74ed0cc850f05fecbf3164ab55413d3e988b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fcdc7b634a27a20fb619cc83b34c74ed0cc850f05fecbf3164ab55413d3e988b
SHA3-384 hash: 643592e4ce06b4602e85b03bbb15da4e659e7476697967b493f84f5569993a0777dafce0cef49af0aeb462326343aa56
SHA1 hash: 5c8025734c2d389e67c3acd0b36f6e9fcad5c984
MD5 hash: a935c3dda1c26033607d0cee7c26fe3c
humanhash: wisconsin-massachusetts-happy-snake
File name:consignment details.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'184 bytes
First seen:2020-05-01 11:27:41 UTC
Last seen:2020-05-01 13:03:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'659 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:vPJ9VWI3q5CzbVgEtMz2aT41YASQCLWxgh:pLWI3cCdgEtt4RASQah
Threatray 27 similar samples on MalwareBazaar
TLSH 70941247DF88CA27C88C0BBE4265170D9B79CAD73042DF5C5BD21A951CE3B716268ACB
Reporter abuse_ch
Tags:AgentTesla DHL exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudhost-144190.uk-south-2.nxcli.net
Sending IP: 165.84.219.64
From: DHL EXPRESS <support@dhl.com>
Subject: Consignment Notification: You have A Package With Us
Attachment: consignment details.rar (contains "consignment details.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48211.26510.18236.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:52:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7tohwy2ke6ra7nqzzsb3gtdu5ugmquhql7wl6mlevnkucpj6tcfq._file
Verdict:
malicious
Similar samples:
0af44b9553823391f942810e491b2160386c70982d0ee3e5ab745ae161f7572d
AgentTesla
1dc7b9bc7fc4e17e45e76dfb99d0106802a503fcadbe1669a0fff3499a55eade
AgentTesla
274402fb25f2eef022a8c983908731a36aeddfe2f547057ea6c2e172a8523891
AgentTesla
689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1
AgentTesla
7af2440f0716f18f1d20faee99d68c25bc6e4a3eff067e759d2167aa5211221c
AgentTesla
81eff2f0b42e94d5ab75e2ca27dd3436394c6cdc059c6818ab30f5136dc6f7e8
AgentTesla
a46a22affb92f4a76e9a0356c13fd5a8468c43af1b5f3e23d563fcb17331b69b
AgentTesla
c599667585688c32aa84ecbdad1a01e93e4a92beeab76c48f1f415234ce26b6c
AgentTesla
f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be
AgentTesla
f9eb36080d1ab8f016ff0f132add3bd220f01fe6220c9ce3ef554e98318bd33a
AgentTesla
+ 17 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6635be1b694b559926c4d131b213322519f7080ba86e09c49bb9af995ec3830a

AgentTesla

Executable exe fcdc7b634a27a20fb619cc83b34c74ed0cc850f05fecbf3164ab55413d3e988b

(this sample)

  
Dropped by
MD5 33da443eb74a094026bd6a6324cc4bac
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 6635be1b694b559926c4d131b213322519f7080ba86e09c49bb9af995ec3830a

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments