MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0722cedd5a2e4a5a4c94ac988f14800a6a83a8c7147f7ef52b47ae86571384e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0722cedd5a2e4a5a4c94ac988f14800a6a83a8c7147f7ef52b47ae86571384e2
SHA3-384 hash: e861bb2522aeacd8196eaf3bbec5e66ddc982071b2f202ebe7cad4bfb0d65f897c1f7edadc4ca359209978865912f6b3
SHA1 hash: 87c1453d0a43907732d4b872f12f3077d5355574
MD5 hash: 5a7a51e6cd1840300c6442bb3baa4044
humanhash: gee-yellow-iowa-iowa
File name:BRODOSPLIT ORDER .exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:311'296 bytes
First seen:2020-04-28 20:09:05 UTC
Last seen:2020-04-28 21:24:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:DimhoaEvVfhLZqDwfLs3bdqcKANhWoYCLfN1qvVa/zaW6:D5hovVfhawjs3pqQNAjCx1q
Threatray 68 similar samples on MalwareBazaar
TLSH 696405395DB81633C57EC2B9EBD48437E1F191266121EA662CC783948BD7E4663C30BE
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.42943.17395.7173.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-28 00:38:16 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4rm5xk2fzffuteuvsmi6feabjvihkghcr7x55jli6ximvytqtra._file
Verdict:
malicious
Label(s):
hawkeyekeylogger
Create hunting rule
Similar samples:
170914b423f415bdf562a5ee3eff48808d4b0731013bcdf870bfdf2bcded8caa
AgentTesla
1d98e18806cb0b478899854bf39ff2388225501a109405db1816066643224ce8
AgentTesla
1feba709f7083e662329bd86c2058ed16e38b02334f315016a9cdd27d7775734
AgentTesla
35cca711eeab74520897fa7d78a5228861e9eb0bd2f66e1aa3810784acf4f11c
AgentTesla
4dcf1134a50b6c5ffd72fed501638c2e6d1c820c5f949190182c9a6b6841b437
AgentTesla
517d8b2852f709db4e9899576e5e1b1b848427b7e0829a7f918a6dc8875772b9
AgentTesla
97b8bdb2c3d831301d68b883fea274703bd497462caa192f6a09130a0f42d10c
AgentTesla
b0ffdd919be61a2c5329c7321a3beb4bbbd0a9a2d413e6a11d7f6803c662d04d
AgentTesla
ba783a6dc1161f2de26ff815457e19aa6918ad4d6bc87f048bc00975ea4a210e
AgentTesla
e4d4a2336be1fc111f68301d7007a79a9b8057864c1d92415de5b4782784682e
AgentTesla
+ 58 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments