MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b25f3db74d63d42e8cf1c5224ec5b1097036e4ee3339c961d0bf681506dad883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b25f3db74d63d42e8cf1c5224ec5b1097036e4ee3339c961d0bf681506dad883
SHA3-384 hash: 1486bb1442fb6b5f8d4eb005fd70b7e658c0d6466169ae2a53ad7c23ae509024c72e60765c6ee08fb266f3bce23671bf
SHA1 hash: 96fa5b7b734d13112acd540e17d688ee3211a41f
MD5 hash: bf14de851cd1dca5ebfe66219d8e6682
humanhash: princess-oven-video-muppet
File name:PO.doc
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'930 bytes
First seen:2020-04-30 09:47:28 UTC
Last seen:2020-04-30 09:48:12 UTC
File type:Word file doc
MIME type:text/rtf
ssdeep 96:KzJtaxG+XcLJCdwi3ojlwtiCzEh7WR320ShCA:+RYixwtiCoh7WkhCA
Threatray 10'595 similar samples on MalwareBazaar
TLSH 1A81F8602A0DACD1E76394E5C82BFFBE8293F64146DE2D51622CF9570BBB0378925D41
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27301.RtfHeur.BadVer.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.FakeRTF-2.UNOFFICIAL
Create hunting rule

Rtf.Dropper.Agent-7726611-0
Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.170830.UNOFFICIAL
Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 09:16:57 UTC
File Type:
Document
Extracted files:
3
AV detection:
17 of 30 (56.67%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
204f690898978f91c9c1fe23dcbd519bed1c67c7621258f0aeae2b2f58fbe615
AgentTesla
3168af462696c8edf2bb2ab1537782ca60135573d977c6d3264ca2069871d9b5
AgentTesla
37f3611503d3e8828f5acc568dc065e4fadc60558d1812d3473140d21146c0b4
AgentTesla
3e4c4376c736f74bf5ad2b4854f8e28816e1519c86881e3dc7086506cc7950c2
AgentTesla
4a2c1f3c1df5c34f1c99c8f7cc8b18fae2c71189e6e383face3ff7fa31224f52
AgentTesla
8941d1279e3899cd7342a1f7f1b6da470544a2685e1cdd320be9fc194bea36a9
AgentTesla
bc1009772fd685f88c177412db4a333a78723286e656e1f6c0601569dbc3e6a1
AgentTesla
dff01b9f8946ed3792fe4e32ae3f95834c892f16ca219dc99d78fd15064f82a2
AgentTesla
f35fa2a6281a2a24016729d315083a638edf176a890a605dba2ac134e1733bb3
AgentTesla
f8bf34d96ec1821d738a6607f98c114d74e93a55d4d4b21e5fc22354177190b2
AgentTesla
+ 10'585 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments