MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67a5b58d36ef0884ee86d601a72ffb085c02aa9cfa40cd3a869ea6806084a011. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67a5b58d36ef0884ee86d601a72ffb085c02aa9cfa40cd3a869ea6806084a011
SHA3-384 hash: 1ddde60a05a03cc6faecba5f6184a05b364366635d522db8e2bc6c1b4166141f4457870c20eb5f9268c798892a8da62b
SHA1 hash: 4eec5043d8f83fce82c0cf4c78a63c95a7c9113a
MD5 hash: d98ff6ae9269718b99d0152113860724
humanhash: pip-shade-charlie-johnny
File name:wizzz.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:907'264 bytes
First seen:2020-05-12 11:30:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:euv1Ts3U+FMZW99A+xvW06ksaf4L9NPrcTI/E0HdWnZ3wv0f+m9EwgSvH:Bv1kU+iZW99lvsZLn+I/E3gv0f4wp
Threatray 520 similar samples on MalwareBazaar
TLSH 6315F14027AD6775E07A9BF559B06011CBB5B02BB5B8E39E4DD260CA0AE2F81CD50F37
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48635.10009.6817.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 11:30:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6s3ldjw54eij3ug2ya2ol73bboafku47jam2ougt2tiayeeuaiq._file
Verdict:
malicious
Similar samples:
0ffa7ac2091ab004e6755e1e66539633b6a628e90094d80357895df0e6092f9c
AgentTesla
2222ddfcb76c8c278bbabf1b094e47950023f1319ae484d44dc502b91700db17
AgentTesla
239fca3f5df496aab1b7c7696aaa26d77174501abc9cb1c1e12a188584d745cc
AgentTesla
3ab173f1c673d450f1f9640193efc87c76e64687e4c43ea0024287c875cde792
AgentTesla
5f2f26cf27b0ffb53cf4a5ddec0d2fcd1236eaf7f4af3a7b78d9d23a23e4cb50
AgentTesla
92fe26c8230e536786caaa0932023f795e94d364ef3221a728d81d7ef90afd2a
AgentTesla
a007c974d0e999a91fb8e3c81489642b608dee675c411d99baf42499c64cc1a8
AgentTesla
b8a97b4c697cfa9f47414d83d6dbc0bf21b52281c1d018904ebcfe52cf88a108
AgentTesla
c324d9dd65de8e5ad44795db94a24c3b2b3db5cdd88d5c35de386e039772a364
AgentTesla
d17e7aae62fd256c264b2602f913c5b918501a1416abb5c58a4f14bcafa2b0d6
AgentTesla
+ 510 additional samples on MalwareBazaar
Result
Malware family:
masslogger
Create hunting rule
Score:
  10/10
Tags:
family:masslogger coreentity rezer0 spyware stealer
Link:
https://tria.ge/reports/201109-xcclxxesbx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Looks up external IP address via web service
Reads user/profile data of web browsers
rezer0
CoreEntity .NET Packer
MassLogger
MassLogger log file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments