MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara 4 Comments

SHA256 hash: 54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7
SHA3-384 hash: d50151158bb9e2dd5ffbd39ead32b2d0a9e5ddf52a25ab61e4d44becbf9088d248f0f7434f93c1a18d5639decca4a11f
SHA1 hash: 8781c4b55d8e3e66458f3e3584ebf98821ae1018
MD5 hash: e3a86615deaec978525332219ef8079f
humanhash: quiet-robert-tango-florida
File name:0093847642020copy_pdf.exe
Download: download sample
Signature AgentTesla
File size:447'488 bytes
First seen:2020-06-30 08:59:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:3fUzwGUIGsZcGSEAiSwlCQuNynnl/S/4ePh9:vUzwGUITcXEFSwljOynl/gLPr
TLSH 7894F198776D192FCA3C15FB4486A24807F9A4BA3453F7D94CD671DC48DAFE80503AA3
Reporter @jarumlus
Tags:AgentTesla

Intelligence


Mail intelligence No data
# of uploads 1
# of downloads 33
Origin country US US
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17041/
ClamAV SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 00:12:00 UTC
AV detection:23 of 30 (76.67%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-wztjfvbx6x/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 47.22%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments