MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96997f504d7aa83bda7f5c69ae75f46dad3d88d4b5cfa71ef49bfee005de417c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96997f504d7aa83bda7f5c69ae75f46dad3d88d4b5cfa71ef49bfee005de417c
SHA3-384 hash: 1d795343f607a7e3d1de477f5fb65f07a01dd88b78cbc751704af4fd2326059325b3976292b6f77818b3ee46c0fd136e
SHA1 hash: 2742ca72c1a93f6deb46f191a0c7525c73d44e65
MD5 hash: 09f2b5fb37261d4385e2f48c9cc4eef6
humanhash: mars-spring-avocado-nebraska
File name:09f2b5fb37261d4385e2f48c9cc4eef6.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'408 bytes
First seen:2020-06-03 10:20:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:oo0Dkvk8+DOoOXno9qVGGIb1UnH2Bx2d92m6SURKHFEDmKw7jpIFjJ:OqlpnH2Bx2WmOQHemKs1yjJ
Threatray 161 similar samples on MalwareBazaar
TLSH 11A4F15872ECBF57C97C04F9E852614883F9916A2695EBC9ACD274F682D3BD00B11F83
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 08:16:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
13
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s2mx6ucnpkudxwt7lru245punwwt3cguwxh2ohxutp7oabo6if6a._file
Verdict:
unknown
Similar samples:
0cb49e44e2ca1f86dc7d71e10908ea9ba43961c677ad25197e6767d2160c17e2
AgentTesla
1c6ac6be305ac77d399c72e949c2b695ea30cbfab2ede5cc72c2d4bd5aea313c
AgentTesla
200bba1fb5b7880c75ddb30bead5de040d079208d6f8fb3ce9bd3e2cb9e69a69
AgentTesla
587201350f1607e78ccfc8809dd7c8646ddd44ec4db8933b998043b9fba5bf72
AgentTesla
8a7a1550c2b3e4bee2a3252e954ef1b6528774fd2805559f125fd99150c35402
AgentTesla
9dd769cb464834591e19709c8e98d97f84dbf86b3e8d35685e88373c1c73c549
AgentTesla
b4503b1f94a4b6767b17edd3cd2a98cf2b8007df820c6b57826985425fb3294c
AgentTesla
d2a97ab97d0977567f4b2ee6ba659725fc82e9d4fbdf293b5f2bed5152d40af5
AgentTesla
e62a6a483967535a39f2678450d936f729871bdb33b019d477935669ac573220
AgentTesla
f6d0d87029e9fe0442daace762e6a0f50db7091ac9417b30e43ba63f9598d5b2
AgentTesla
+ 151 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-ytmmcwjrga/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments