MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c17951fe8ce164bbeffa514861c191dc57da3f676ae0e7e19ef62384125c127. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c17951fe8ce164bbeffa514861c191dc57da3f676ae0e7e19ef62384125c127
SHA3-384 hash: ca3d36059188bf75ffbce628ffb44d18003cb457185219781f5a2f70c3033d4879f29ad14205680f51c47c7b8d228d07
SHA1 hash: a2f62863582dad942f7a51f93e3302ab8b83e1e5
MD5 hash: 7aeeb42112dd5bad4966cec86fb28a0b
humanhash: oxygen-jupiter-finch-cup
File name:invoice copy.doc
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'357 bytes
First seen:2020-04-28 05:54:52 UTC
Last seen:Never
File type:Word file doc
MIME type:text/rtf
ssdeep 96:csYBuEeDzRbFJ6avomVaiUu+1s4QBwHuTRK:bYBuEELJhvomgdr6K6K
Threatray 10'545 similar samples on MalwareBazaar
TLSH 85614B6D9D0C0E06D7D2EA5FC2CB3E6845AAB08499D936CC35ECCDE41F236209D20910
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27301.RtfHeur.BadVer.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.FakeRTF-2.UNOFFICIAL
Create hunting rule

Rtf.Dropper.Agent-7699854-0
Create hunting rule

Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 07:02:45 UTC
File Type:
Document
Extracted files:
3
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
120e669f0b8365acc401d463a56fce652e36f300ec9ac4caa53af22a4bd3d479
AgentTesla
2364247c3aeffef1ab3a097e386e61917c7083f53e016888d5c450e9f1c656ac
AgentTesla
2add456cb2b187d4c68ab73ed02c7b6358add98e5c5bf3f084432645e3c37851
AgentTesla
3a50e52732ad555ed6f785c81ab6b0aa11c4360a4a6a5c7daab07286b376a259
AgentTesla
9251aefb3d0f5c1a21c9de09cb545c28e64c99c7424cba4021248f2cd35e6409
AgentTesla
c85ff24372320b72baa0652814e4288eeb120f94c98e50f59a90a706bf720b1a
AgentTesla
d569c0cfd280490ff1d726b75bca9e64be8352671e8aaf41b26e583c82690cfd
AgentTesla
e2ee107b59612c9ca7bc1df9d460f3c7205503aaa92346bcab201cb7c153f25a
AgentTesla
ea2e7ec387cf91e0ad3d44c01b25adc702061e93b66d21f8b3dd1eab812045f9
AgentTesla
ea56935a4dca19d4ed31da39e7e861574186defbb63896045cff26a38c5b3ae7
AgentTesla
+ 10'535 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments