MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f2f26cf27b0ffb53cf4a5ddec0d2fcd1236eaf7f4af3a7b78d9d23a23e4cb50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f2f26cf27b0ffb53cf4a5ddec0d2fcd1236eaf7f4af3a7b78d9d23a23e4cb50
SHA3-384 hash: 461a5ef709a74b5b2095e3afe0ea7b59b0c33415b6bbcfdb03f4c4b42629d12abf63b6b0fa46c97d977e2d86be5ffab8
SHA1 hash: 31d992583df5918b80449d294c9d23c667c6f8bd
MD5 hash: f3a3104e925c90dc25b334ee41ecdcaf
humanhash: fillet-princess-cat-beryllium
File name:ebba.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:918'528 bytes
First seen:2020-05-12 11:29:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:1SXzJtODMXoDpLVHfBb523RVaOqB2PrL0Y6Wcom/3WcQt4bnsaCpSbCuu9AQcX5:oX9ta2oFLVB5AeOMQoSQQtesavCX
Threatray 512 similar samples on MalwareBazaar
TLSH AC15F14037AD6721E17AABF548A0A141C7F9B5277AB8E75D8DD520C61AE2F80CD80F37
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48635.32179.8015.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 11:28:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4xsntzhwd73kphuuxo6ydjpzujdn2xx6sxtu63y3hjdui7eznia._file
Verdict:
malicious
Similar samples:
2acce03be9204acbcc6fc59fa5bebc3720d91a9d7daa122c0ea086c4727fafce
AgentTesla
58933d7bb0147da562d240bc3c9974ecaa552f35495a773345e1e7d158f39588
AgentTesla
58fa191f38b25cab67921a0f3c0aba75e5254ca139733df9dca6eec26fae1377
AgentTesla
7a55018c2903edf26bdfbbd5df47c352197170b75a04af058a35d2332d9e6b50
AgentTesla
9fed5314906b5873cd970313215aeb2714819bb965dc4bb7648154f1dddb6680
AgentTesla
b020ed473e1a965d4de31c00fed475e683f808d9665b207bb41cfdb77f53bcfe
AgentTesla
b9f1a9cdb6f068f9222b8cd906ed162d74be5662bb9dbad5540d8cc51d1a4e6a
AgentTesla
bbb3afd846cc51e61380effeaceabc21e15c8b4ccdab6d821697191605a00c60
AgentTesla
db54bb9d7b9d9bba3cf4945c6eb5f637f4726f5009d26e14857ff303abd16e7a
AgentTesla
f7216d025821af6be807018f12db7c5a5bd3cd21ef0176b02c6cbe0f05ac4cf7
AgentTesla
+ 502 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-wm6yd5mey6/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments