MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 537b7da6fce7f85c0343f1f181e3235afa6089e16b58f094213bee5b274cc676. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 537b7da6fce7f85c0343f1f181e3235afa6089e16b58f094213bee5b274cc676
SHA3-384 hash: a6319e13f1999994bb3cb86fdbecbe5a18661fd4eb220ffbe943fefd70bf93c3048e20230a46615f3a4a97a37e795dfd
SHA1 hash: 17b7a682d2388e019b0cb4ecaa30a867d707e195
MD5 hash: 2e0d6b1c8d1dca23464b2c800730d9af
humanhash: four-hawaii-orange-lactose
File name:purchase order.exe_
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'320 bytes
First seen:2020-05-25 07:10:33 UTC
Last seen:2020-05-25 08:26:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:DdVNV606j+UY4pLWA2R+zNFhZ9R8Nxml3EcW5jCMl5Lx:T602YgiA2R+JbZ9RlUc+Z7
Threatray 10'629 similar samples on MalwareBazaar
TLSH D29412C123ED9BBAE67AC7F86430291113F6742B3A63D20D8DD620C745A7F854C25B9B
Reporter oppimaniac
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ELCE.26416.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 07:19:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c7de15126c912cd1ab00cb0ba1f5504272eba4d87912f4251431892d5a2a375
AgentTesla
166087b5c6159f9d5ec3df7b7359f111692e0b8d93182a633abeee98aab686f0
AgentTesla
38525021970c707fe513c2589e60dbd8ee2d052e1f4700837a5b132b28baaa33
AgentTesla
8621d034aa3d308052ba9371dca6cf2d5a5b043b2903d3005c21f368525abde8
AgentTesla
92891933f5cd5e261f775149ca28b09ac1470b28a5d42d533ab5ed1712c18229
AgentTesla
a0afc50b1bf0b11bc769984284ef2a58c54197d6d3aaec7a20c777d26fa31d58
AgentTesla
bc3401d05a180606f7593e377e8bb1070c06c90cde1e268954f43e44d8b571a6
AgentTesla
bcb7da4d62467320eadecfe6d6157941a2b73d24a22925465bacf3c434aae525
AgentTesla
cd783cf39d3c362320de7fbf1d2d5f7442f042ac47bd9198a9a1a4477b0d5b26
AgentTesla
df8cdd9b1fe005069e7864024052a36048121cf6e34d3209de1617ec01ce5415
AgentTesla
+ 10'619 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-lqa9s7k14j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments