MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0
SHA3-384 hash: b92f4863e68d1d89e3ee3d410e389772e85b4ba0ccf01ab23247531deeb55b16c40878caedb58348e6c9fee80466eac5
SHA1 hash: e535f38da0f97f33e025829092662493938ced2a
MD5 hash: 95270b6e8eb05d560e4fcf703353e16f
humanhash: football-oxygen-johnny-october
File name:Siemens September purchase list sheet.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:941'568 bytes
First seen:2020-10-09 05:37:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:jXkETjrtDBUS56iQKUVPzDN8VnBCWv/PJslaPR0jjjHUgfS3O1r5:jXkETntDBUSENBPzydAmPZZ0H7UgK8
Threatray 405 similar samples on MalwareBazaar
TLSH CA15D02A73649FCDE03E6FB44D24711063F0BD2AD362E70D3CAA219E49F2B80556775A
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69382/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Creating a process with a hidden window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/486217
Signature
Disables Windows Defender (via service or powershell)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 295553 Sample: Siemens September purchase ... Startdate: 09/10/2020 Architecture: WINDOWS Score: 72 32 Sigma detected: Scheduled temp file as task from temp location 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Machine Learning detection for sample 2->36 38 3 other signatures 2->38 7 Siemens September purchase list sheet.exe 1 4 2->7         started        process3 signatures4 40 Disables Windows Defender (via service or powershell) 7->40 10 powershell.exe 22 7->10         started        12 powershell.exe 24 7->12         started        14 powershell.exe 25 7->14         started        16 14 other processes 7->16 process5 process6 18 conhost.exe 10->18         started        20 conhost.exe 12->20         started        22 conhost.exe 14->22         started        24 conhost.exe 16->24         started        26 conhost.exe 16->26         started        28 conhost.exe 16->28         started        30 9 other processes 16->30
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 00:55:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
35
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=72rgbwgjp23k4qdz7m3zkflgxhzozd3yk2ekh73dxr4dhnwoxxya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
024fe29d6f94fe5fb1afead83c7e0deefa8127669e8e66043334b6bef130f9f8
AgentTesla
0a9e76d04b5ad405d59b6092f545f48dac62b1ce8ed10a260e4f90edff474c24
AgentTesla
14fcbebcc9d8c68ee30c888473ddb5fb08d4f0026b506c66668acb8c49ff0146
AgentTesla
30798ac2e4157b25f548e10f23743df081e52bb62865f3bf539ff54440d6c520
AgentTesla
655f642f75237fce5b0547080777dafc29d864bd41d0b53d4f754c205ef499a1
AgentTesla
a3510ca0d8cbd8fb1035c1c59a8781abfc1e463d0429e108c242c23188f1adcc
AgentTesla
bc2e03ca292da305602c8755453fa87073810a6359f2ec9a0935fe3bb51ef886
AgentTesla
cf22a4ba35e94ec83bdf1aec7b4422009aa33f7c6a2c707513d7b1a9eafb368c
AgentTesla
df2618236af018e94e2c167826edfed81faab5a6c5ace255d84d9f07296a63c7
AgentTesla
f2534f52eda2331872b580d6e36f66969b14c0c1407901e41e563f5ab147708c
AgentTesla
+ 395 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/201009-phc4jxscxe/
Behaviour
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Windows security modification
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0
MD5 hash:
95270b6e8eb05d560e4fcf703353e16f
SHA1 hash:
e535f38da0f97f33e025829092662493938ced2a
Link:
https://www.unpac.me/results/6c02a24c-934a-4efd-b66b-397f273855ce/
SH256 hash:
4b9011f7d20e436192b4b7e4f87b831baf98696bc646d1f3b518a76f690668d1
MD5 hash:
5d92ac6b8c0ae2f401e86a938d808a8b
SHA1 hash:
1b11ac668dd4ef5c055973794d353b04e2fea020
Link:
https://www.unpac.me/results/6c02a24c-934a-4efd-b66b-397f273855ce/
SH256 hash:
13b24d3a09d099dabe41cd6cd71607a77e14640b1e9b4ed2d60f6c012f191c43
MD5 hash:
109cedae3c384a1913107f1efad2b7c8
SHA1 hash:
1f7f35b0ed85fa12bb839cbce698e59a30813420
Link:
https://www.unpac.me/results/6c02a24c-934a-4efd-b66b-397f273855ce/
SH256 hash:
ecc379b42a5a1ec244d341602d8372c86e3834c4c6280436bb9cfe4e85fccab5
MD5 hash:
9b6723a2c7e788de8fe2bc2e0ffe516c
SHA1 hash:
a14c5787dfb898030ab498b3a2dedb975fb33c9c
Link:
https://www.unpac.me/results/6c02a24c-934a-4efd-b66b-397f273855ce/
SH256 hash:
2dbf17289b8533888b56bafe15b13bf1ec105221a270dfbd05d3b8bda35c4652
MD5 hash:
689e1bcbaecc4c948d669701197bea91
SHA1 hash:
b06492767c3dec1fb6fa2a2cd875bd641459a15f
Link:
https://www.unpac.me/results/6c02a24c-934a-4efd-b66b-397f273855ce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 934ad1b3b4ba0558f25b16c2730936107158875ec56a54b115e6fe279e9caf20

AgentTesla

Executable exe fea260d8c97eb6ae4079fb37951566b9f2ec8f785688a3ff63bc7833b6cebdf0

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 934ad1b3b4ba0558f25b16c2730936107158875ec56a54b115e6fe279e9caf20
Cape
Cape
https://www.capesandbox.com/analysis/69382/

Comments