MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085
SHA3-384 hash: adaf011c7d242e6014995fc3c1caa3581757602d99ffca21b22840b5edde78059263ccd87937bd3938ff29a4e728ef1f
SHA1 hash: b7cdfb49f1edeabdf3f3d9da3ef6758abc889ab4
MD5 hash: 85bc261f3b94a42bf4a33c4ae7237b3b
humanhash: massachusetts-fish-georgia-tango
File name:Acil Siparis.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:259'072 bytes
First seen:2020-10-19 13:23:03 UTC
Last seen:2020-10-19 14:21:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 3072:JDOphXYf0wjpxqX3u8o26lCpSQCWQ7FITV07BZgfklVEsTHtB5BazqC6Zu4+eXX0:JGXYrpAHh6lCpS7WQ7yUgf+j5Br+a0
Threatray 10 similar samples on MalwareBazaar
TLSH C1447C58B3DA45ADF2DD9E32AE9127138736FC936FAFC787540671540E333828C51AA2
Reporter abuse_ch
Tags:AgentTesla exe Telegram


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ditas.com.tr
Sending IP: 193.142.59.17
From: <tuncayaykac@ditas.com.tr>
Subject: Acil Siparis Talebi
Attachment: Acil Siparis.img (contains "Acil Siparis.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72972/
Detection(s):
SecuriteInfo.com.Artemis85BC261F3B94.27670.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% subdirectories
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/495511
Signature
Adds a directory exclusion to Windows Defender
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 300235 Sample: Acil Siparis.exe Startdate: 19/10/2020 Architecture: WINDOWS Score: 80 23 Multi AV Scanner detection for dropped file 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected AgentTesla 2->27 29 4 other signatures 2->29 7 Acil Siparis.exe 1 5 2->7         started        11 messanger.exe 2 2->11         started        13 messanger.exe 2->13         started        process3 file4 19 C:\Users\user\AppData\...\messanger.exe, PE32 7->19 dropped 21 C:\Users\...\messanger.exe:Zone.Identifier, ASCII 7->21 dropped 31 Adds a directory exclusion to Windows Defender 7->31 15 powershell.exe 25 7->15         started        signatures5 process6 process7 17 conhost.exe 15->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 11:13:01 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ub4q7ldqxz5qzaaermqfsbbwslpmayqlcd2ax3h5nuur5gfyccq._file
Verdict:
suspicious
Similar samples:
0e9d08e343babe7fc9d6e9a9df3e29b8b5bd4b080a5cb32bd744cf02997d93cf
AgentTesla
1b399acbc2227f52d5efa817d7ddff99105d6bb1bd4ddd5f4f6c769d6ed57518
AgentTesla
2c76a946613af327c39bc27c9eadbdc130c649ec0b34a21db170b0bd6662f7bc
AgentTesla
2f96167c307b2b82ca3ed1b6b6368b607cb075e178aef0ea4ff7bd4c203e7d6b
AgentTesla
3d51c6c8739a9038ef4a2fd3c255ccb1206ea5e4e148af61ec47867395d3540d
AgentTesla
54cc7fbd8c21b80fa350cea51414fda2e2d1673c80ab0eeab0ec851f51e847fa
AgentTesla
c13f524ec129f1d14e10cf9de34fde8dfc121fb5d832272d7eceebd9a32b77c3
AgentTesla
ea49f722d6874e9b0b754f8116edceee6cdf4b85aa893d1b86053bfc506e5602
AgentTesla
ed9d96725b88ce0a3caee6d98c11369fb84a1d7eca3847db66abe63c49955f73
AgentTesla
ee1a9615502f7e593a97d94528cffa575919ee29820bc99c27180296c228d5cb
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:agenttesla persistence
Link:
https://tria.ge/reports/201019-mcapa8xbnn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Unpacked files
SH256 hash:
dbd881ab3e29d5c92971a644d63f67f6d93adc801c240f264b5e629ed2c2f769
MD5 hash:
70e8eb8aaf5ae20211e353d57d81c8c2
SHA1 hash:
226f21dd57619573113542d2de72231d0799a372
Link:
https://www.unpac.me/results/a55d6db2-420e-49de-83d2-84ef452ff9ca/
SH256 hash:
6358978d032f67ed56068f499acde00d2acb6574f5c44b55c5954e4b50e6a8b3
MD5 hash:
6cb8b61aca223feba0ae19da168c2aa8
SHA1 hash:
a824e38b6de5591e16725612df8dae1fd5c6555b
Link:
https://www.unpac.me/results/a55d6db2-420e-49de-83d2-84ef452ff9ca/
SH256 hash:
fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085
MD5 hash:
85bc261f3b94a42bf4a33c4ae7237b3b
SHA1 hash:
b7cdfb49f1edeabdf3f3d9da3ef6758abc889ab4
Link:
https://www.unpac.me/results/a55d6db2-420e-49de-83d2-84ef452ff9ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 095c042eb4d4a96d8b1e57776613985b01f8a3720657c61746e5f84a48d9a190

AgentTesla

Executable exe fd03c87d6385f3d86400245902c821b496f603105887a05f67eb6948f4c5c085

(this sample)

  
Dropped by
MD5 fdc41e7ee4f4f0c93407d8fe928b9eba
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/72972/
  
Dropped by
SHA256 095c042eb4d4a96d8b1e57776613985b01f8a3720657c61746e5f84a48d9a190

Comments