MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff5a506b69008ad7cc902dd5ca6b0fe6c2235e532b9b2421bf4b86dd2b13462b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff5a506b69008ad7cc902dd5ca6b0fe6c2235e532b9b2421bf4b86dd2b13462b
SHA3-384 hash: 3c52c579f1741052980beddc44010afbe005bbd4d7e426f3ddcf3f1f63f8eade71aa5f812455983d67388bdadc3d0e95
SHA1 hash: 475a2ce455dc70be7c795bce46b8a8cbeaff833a
MD5 hash: cad5266dd3b307284b7cc780a4863b3e
humanhash: oxygen-vermont-happy-wyoming
File name:NW Swift TT Taranan 3884930049 hesabza 31000 ABD Dolar tutarnda bir odeme ekledi PDF.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:359'424 bytes
First seen:2020-05-09 16:07:37 UTC
Last seen:2020-05-09 16:43:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:Tj5LNk00oTib100vTnNpfw4CQ28ppvGsu+wnY3yKChUgkHffgi4W:Tj5LNk00jb100r7CQ28p5eYDgFo
Threatray 26 similar samples on MalwareBazaar
TLSH B5740123AA95D633CD8D1EBB4472275C573C87AA8A06D39C4DC5B84A1C9372061E1FBF
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.chaiyohosting.com
Sending IP: 58.181.206.8
From: bilgilendirme@vakifleasing.com.tr <tob@erawanfood.com>
Subject: AW: Documents
Attachment: NW Swift TT Taranan 3884930049 hesabza 31000 ABD Dolar tutarnda bir odeme ekledi PDF.z (contains "NW Swift TT Taranan 3884930049 hesabza 31000 ABD Dolar tutarnda bir odeme ekledi PDF.exe")

AgentTesla SMTP exfil server:
ftp.universalinks.net:21

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EKGZ.1165.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 14:47:18 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=75nfa23jacfnpteqfxk4u2yp43bcgxstfonsiin7jodn2kytiyvq._file
Verdict:
unknown
Similar samples:
0edd45b70fa551b13b37faf2146011fbdb3299e69f20bedb7e48c1710d3a0159
AgentTesla
442452b82edb2b18431c296669c78df1c88b210775e9a9b5d7726a1092a8fc6f
AgentTesla
6575a80b5fa70f2b72b0c5270e4bf316efbdda166b73267a783ebe8a56f3cd1e
AgentTesla
6ff25388a91cbed0a11467e592e39e34c54de49d61876a2a201554e67c5b8cb4
AgentTesla
8224d188f60fa7c7b60249b82cd7d94336542a8a21a57c9adcb00530e068f818
AgentTesla
cbb6d89187847aab1fcff6b5d832ea80bca30bfe5520702133cab83335392ead
AgentTesla
d73498e0aabb97375783af491aded66aa6710ba848247de3337f404fa02a35c0
AgentTesla
e43ee2ab62f9dbeb6c3c43c91778308b450f5192c0abb0242bfddb8a65ab883a
AgentTesla
ec639f932f7e3c075d735973cd493fe7a895bf660b4aff4fc4c97af08baf64b8
AgentTesla
fdafb44be84ea918c76a99f4c24c08fbe8de6648a4ad73614f77450aa2b43484
AgentTesla
+ 16 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-9rz93zdjf2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Adds Run key to start application
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Create hunting rule
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z ff57883a3ea252bb35148f43852db94018561323d1dfa58a79d36dec80fa9895

AgentTesla

Executable exe ff5a506b69008ad7cc902dd5ca6b0fe6c2235e532b9b2421bf4b86dd2b13462b

(this sample)

  
Dropped by
MD5 829619a8dec50b92cd241f927fd386b4
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 ff57883a3ea252bb35148f43852db94018561323d1dfa58a79d36dec80fa9895

Comments