MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf8e8c42972e35b388e26c691d634d1406bc14678732b72ee8199b16f3db2234. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf8e8c42972e35b388e26c691d634d1406bc14678732b72ee8199b16f3db2234
SHA3-384 hash: 74de3d75a89ff37d1fcd8f63f0f1ea6600115c19c56b828a9bd387742503e825b69c0d8e190ebf137ed55c5dc1d847d8
SHA1 hash: 37558b079220ead44c69dc57e2601bb777ebc144
MD5 hash: fd36c819c0c611452ec76eb13d864618
humanhash: saturn-fix-uncle-fanta
File name:fd36c819c0c611452ec76eb13d864618.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'320 bytes
First seen:2020-05-20 09:06:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:E3WQvu6wjzVn3b5y4RNLcBqq47QRPGyku1F/hdp:KVvu5hn3Ny4noJ47QReykub/hdp
Threatray 693 similar samples on MalwareBazaar
TLSH 0894E0443B0DEEB7D67829F155A2630D937A7C21708BF6C11EAA24E1B6E0BBC54C59C3
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.kz:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 03:02:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x6hiyquxfy23hchcnrur2y2ncqdlyfdhq4zlolxidgnrn463ei2a._file
Verdict:
unknown
Similar samples:
0cc16629baebcad2253c82ea0625b90df67e4012a56b0bce7b5dea230d6c3d35
AgentTesla
2ed7bf7fecdd83fb1f01697be1df04cd6dbca8cb56a7b4a200b979fb2bff900c
AgentTesla
306c8616d75839fd86d39079605c80a31851700178e04bad8106fe0f0d19be91
AgentTesla
458ec318ffbb41d9980e1fc2cd7c1af12832b62a133a2cde0e92819d423c9ba6
AgentTesla
5ceedeaa99b65c724e1e4356bd44d8ec58b9834e526c223e39e554f93ec25d1b
AgentTesla
6021bc47c304637516833c05a64218b0e77a7075e7e4d19579cad97493db42c1
AgentTesla
a77241c0c913c77f02bfe5e0317d8d08fb35ee64415fde58104e7387fc3c44b5
AgentTesla
bf76c8212c92b159f71c75bd6e2d8f8c2c03d26340203232e9b198ea2509a20d
AgentTesla
cc296ddd36ee729fbdea514a26f387b2b5e88dc6bf3c61c68fb27572703acbb6
AgentTesla
f37489bec7a26498cd8c27c658c53d8477396a446d3580901ba271a1126ac7c1
AgentTesla
+ 683 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity keylogger persistence rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-8z5bwa3zyx/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe bf8e8c42972e35b388e26c691d634d1406bc14678732b72ee8199b16f3db2234

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments