MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02bb0ff54a31436e39c168c4e55237aeb972098a8da8e83eb1cbc99796a60394. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02bb0ff54a31436e39c168c4e55237aeb972098a8da8e83eb1cbc99796a60394
SHA3-384 hash: 0822f835a80648133d34e72918724ce4abf58fd33a2fc05cba927262078cc658c9164f98682974a911f6f511c15fe610
SHA1 hash: c098142787b1255f209c961dc264353957b35fa3
MD5 hash: d616000b5dfaedec1814e6ab7dc0bd05
humanhash: beryllium-lion-robin-march
File name:musik.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:921'088 bytes
First seen:2020-05-12 11:28:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:EZL9GJJV7mwxEEdmBDCe2NC9+Q4qPf47z:ER9GXpE7tgC9+x2y
Threatray 508 similar samples on MalwareBazaar
TLSH 5215F18023AC2726F13A9BF849A0A165C7F5B56775B8D36E4D9264CA0AE3F40CD41F37
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48635.18800.23242.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 11:27:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ak5q75kkgfbw4oobndcokurxv24xecmkrwuoqpvrzpezpfvgaoka._file
Verdict:
malicious
Similar samples:
0ffa7ac2091ab004e6755e1e66539633b6a628e90094d80357895df0e6092f9c
AgentTesla
1379e36644ac0f28d83c4c8b502d96cac61961cf6835c1e11ce214c270320d38
AgentTesla
3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792
AgentTesla
3ecc7f6abd145158004019c01e8f8f7e56c2bc3d9b4625a3fe2e1eee470a7dd8
AgentTesla
426110407bdba9dfe5a4f6d39d6369c8baf47008d7738765c3eb7d1ee62e3344
AgentTesla
5f2f26cf27b0ffb53cf4a5ddec0d2fcd1236eaf7f4af3a7b78d9d23a23e4cb50
AgentTesla
67a5b58d36ef0884ee86d601a72ffb085c02aa9cfa40cd3a869ea6806084a011
AgentTesla
adb0d88a8655a39400e194d8ac9df6e6f3ac28defadf5e4a2686fbcf688bf259
AgentTesla
c7c057a2a841138af9f5e5d0919aa2099c27453600d87c3186896836ba812399
AgentTesla
d17e7aae62fd256c264b2602f913c5b918501a1416abb5c58a4f14bcafa2b0d6
AgentTesla
+ 498 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-tlzh9cgsfj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments