MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23fe3d759096d3abab9d28e0135754ea969c0e7cd9d32d1ed6191debb838e77a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	23fe3d759096d3abab9d28e0135754ea969c0e7cd9d32d1ed6191debb838e77a
SHA3-384 hash:	8ab82af20c2a6aecc61c458b48fc2f35082219b798f2ebe5e8a7b7bf0758509cb39f090e06ec93016ffd0987968a64ce
SHA1 hash:	1e9d4b044b5a102d9dfe1d27f7ae4d26eaac4c46
MD5 hash:	b0fb538f0f67c5a7ae907fe8346ef246
humanhash:	venus-alpha-failed-ceiling
File name:	TT Wire Transfar.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	360'960 bytes
First seen:	2020-06-08 05:30:00 UTC
Last seen:	2020-06-08 13:27:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:trp/FGCIYgFKP+fFma3p8TR0qnmv75kJziMuY/loiezk55rHN7F34GArLxYtO:9p/ACLAfl3ubnu75kYMmSVTCxYtO
Threatray	10'703 similar samples on MalwareBazaar
TLSH	0B74F18CB51537EFCC6BC43689A82C64AB6434BB535BE287901711ED8E1DA87CF181F6
Reporter	jarumlus
Tags:	AgentTesla

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-07 20:10:45 UTC

File Type:

PE (.Net Exe)

AV detection:

27 of 31 (87.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ep7d25mqs3j2xk45fdqbgv2u5kljydt43hjs2hwwdeo6xoby455a._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

3f58539eb2353fb30a4d0d2e3e1f8db5c51a21df564c138953fbe1e2bb396284

AgentTesla

4b13b5acc2c0566e5ea6bd47824ef00b96ed925a6b3754df5245e10a5205a2f4

AgentTesla

5d45333978e4e002d9a5c293f6ea8e19a93154fc5e3a7401c793ebeda53588ee

AgentTesla

7c07f9bede2e4dd632d824e779849898ed943b7eb52a2abb2c3d6b6b2491b653

AgentTesla

90c6b56f55742297280258483cd14c0d92575ba6692f9662a0282bb60eae089a

AgentTesla

92f6d1e82205b64904076dbcb9909bc3ff06cd4c58c87518470eefdd8b4df084

AgentTesla

ba1cd3d4f48da85e9f89e0123008b4c26b9e2fec176f7e973827f0a87c74e337

AgentTesla

d3146b1c0e38f200abfdd2439db31b3cc5271d320495015d68ea2fab35e6ed14

AgentTesla

d97d1614a199d784c0697ff01eff3e4d195dd07e65879a59b3b805d2088ad8a9

AgentTesla

+ 10'693 additional samples on MalwareBazaar

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar