MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cfa2cb8bb85c016d2947f42a22af6c29e11e87c6ecb77c3b7b41ea674212643. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cfa2cb8bb85c016d2947f42a22af6c29e11e87c6ecb77c3b7b41ea674212643
SHA3-384 hash: 73a8f661917fba9c1e2c6e89a8c639e30c59f4e29cd562475a666977dc8261e5f73ef9a70a75c02f23e2248049c45145
SHA1 hash: e783b112d4ac8d7ee59c3b2122d477316defa3f4
MD5 hash: 5ec64d8a5498721b2728d15157318dec
humanhash: robert-sink-artist-minnesota
File name:Outstanding_balance.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'624 bytes
First seen:2020-05-09 10:57:40 UTC
Last seen:2020-05-09 11:58:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 52a6531100073eb32b191c309d6a6779 (1 x AgentTesla)
ssdeep 12288:fqdMb7e4cuASzZcETeUiHKVp3lD+B24DSH18IPirPGjYp/V:fqKaMAzEqWV10B24D+18nOjY5
Threatray 11'648 similar samples on MalwareBazaar
TLSH B5A423A6A6D41437D3456633973307501A1EA163878C37738E72E9E8BCB45D1F7E238A
Reporter JoulK
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-49
Create hunting rule

PUA.Win.Packer.UpxProtector-1
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 06:38:00 UTC
File Type:
PE (Exe)
Extracted files:
61
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ht5czof3qxabnuuup5bkekxwykpbd2d4n3fxpq5xwqpkm5bbezbq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
7607102eead4fb3d71ed2c2b492eb4828d5c544576102aaa94d29debce0f211d
AgentTesla
93d94861c9feb7b9fca386254d8ab5637cf78e4145527753fdafe7346d28fbe3
AgentTesla
9463f129f4dec7224eb12c262e080ffa58c104bde38104319ab69d2fdb8919ee
AgentTesla
a72f9a0317980cebc1acdc4f89b372a09004a4fc7537f80ab0eb52b2fc94746f
AgentTesla
acfc26326f526d83c1fa3004df2cacec7decdb74024d645553ab1ec7a9d27c98
AgentTesla
b9ec899a1cb59794313ed0db3e338dbc43970785be52cf756b0d33588c0064d8
AgentTesla
dab4d45b3d041bec38bb40ef34ec38a6efee4c8e582c9032f22d5bca9115c189
AgentTesla
e8435237623f073caefc83ba357864fa6ed91d7d0fee7b67db8620e3a793f47e
AgentTesla
eceaeb5dd1fdf321efcf6c4e33706e025408deaa74ece9fb0e4e145901513cf2
AgentTesla
f98b5f9ffaf0a7c0cf9ee0d77362bacba4db7882cca9d61cab279d50fc57f483
AgentTesla
+ 11'638 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-qddpvhpjye/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 3cfa2cb8bb85c016d2947f42a22af6c29e11e87c6ecb77c3b7b41ea674212643

(this sample)

  
Delivery method
Distributed via web download

Comments