MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b1007700f6ee401de8130b565f68174973568079ff0f323e44507ba830562e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b1007700f6ee401de8130b565f68174973568079ff0f323e44507ba830562e3
SHA3-384 hash: 169b856852c866c09ab0883b7cbab8527fbb2e84fe0052b4749187a424fb4c317aa2d2425ad99a8843c4f9e7cb493b3e
SHA1 hash: 1a318b8c83622b0ec2a30ebfb63a70fe86efb380
MD5 hash: 9002659e37099be409e5323666275d2e
humanhash: oscar-romeo-king-bulldog
File name:9002659e37099be409e5323666275d2e.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'768 bytes
First seen:2020-06-01 07:55:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:Xw4+wed7Er9RJL7Oo5KmkYKuI9L/3pZlW:Xt+weN49r7VKCwJ/BW
Threatray 1'452 similar samples on MalwareBazaar
TLSH C7941268B39C617FD50D37BCA3AA110063F1C12399C6FB865C9990F1099F7EC9A95CA3
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 14:33:18 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmiao4apn3sadxubgc2wl5ubosltk2aht7ypgi7eiud3vayfmlrq._file
Verdict:
unknown
Similar samples:
0060732dcb2f0ca7f2e8866f569ae58536aa8615a612c0f0f9fa9818e49a2a4b
AgentTesla
271d081750e61123ceda8a898533f5b636254030a65f14a71ecae2b8ea649443
AgentTesla
2f4964e14972eafa98f1fc8ad81f8dc2eeb45a00ef420cf59db34faba1592ac4
AgentTesla
2f6a6d53e0ea3b6314279e5990a77c0acd90791f677086bf0a1b40fa48917222
AgentTesla
3be937bd3615e1178d145560c18a2dc17c6301de53bbf16b64aeedf1d6bf0d9a
AgentTesla
400ad786bf1e76812b70a3ab4ba345668fe07c176743f412f6ff5372238c2320
AgentTesla
407a92dc3261682d19c7e6431b78c67470a498079f261d3c729d2e89b689b573
AgentTesla
75b22a0fa50ba829ea6a30ab9bb769209bb30eddda709aa0e8d04eedb7156ee4
AgentTesla
9841eb92f550105bc744c34152086e2c6624e08b2a99c24c9084bdc7add30508
AgentTesla
f0006754d451556014c91039915ea9505f348f80538e536d30b75c5ef252d73d
AgentTesla
+ 1'442 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-xwe9mw1vpe/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 4b1007700f6ee401de8130b565f68174973568079ff0f323e44507ba830562e3

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments