MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bff0771ae9dbc7078a6afdb9fd366c5f3464606897e2710f09240981fa57ff9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bff0771ae9dbc7078a6afdb9fd366c5f3464606897e2710f09240981fa57ff9f
SHA3-384 hash: fb7331c3659c80ddc5785e98bffe94699e73e8ccd138ac9dabfb831940625d3c2c1d8947979881a2a1d37f4efe9b3fdb
SHA1 hash: 826db53d2ff01a0d467aa04e44bf2b8eb04e7ae7
MD5 hash: fd216747a17e97b2ab1f2d3de7a49202
humanhash: spaghetti-helium-georgia-item
File name:UrgentPO.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'423'360 bytes
First seen:2020-06-29 22:22:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:htb20pkaCqT5TBWgNQ7aV32hv5vmQs03eZEvxvgxZf0Xe6A:yVg5tQ7aV32hlmSOZM850u5
Threatray 10'934 similar samples on MalwareBazaar
TLSH 6665D01273DDC361C7B26273BA257B016EBB782506A5F56B2FD8093DFD20122521EA73
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/16742/
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bff0771ae9dbc7078a6afdb9fd366c5f3464606897e2710f09240981fa57ff9f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-05-31 03:19:57 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7yhogxj3pdqpctk7w472ntml42giydis7rhcdyjeqeyd6sx76pq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05848682dd2b150148e00c2a825437806aa7a32f56048ed33d57c1970b225ab0
AgentTesla
18bc1bb7ff629d8aa9646875c02636074f4039b39f48273ff97fe7c12f401e00
AgentTesla
286d16862690f0f955f753c05844161a7b81a94fc8d78400c849f18b599b00b2
AgentTesla
4fe5c10150a1e788688ef4b10d8132b47d2796cdaa2933f1332eaa3194f16143
AgentTesla
7a72048dc59d771103e967e14062f773dff0f01681d0b53a0688c2cfda755ea2
AgentTesla
a06f9875fbd7c80708d10e1e05b86d59473eeb69ebaa16a136bd2bd93087af3b
AgentTesla
b053fe8897703c165d38c04c52e805aa77e4e6c6ab2981eeb298786936ad0660
AgentTesla
cdad1c467cfe5f914801c1156a92b6c23baf8abf4681a098f0bb550c890d874d
AgentTesla
e17dd7465e562b968e49754fa5248ee2f45c5f7ae7111161215287f5340143b3
AgentTesla
fa029f3f149b2c256dd41171fad7844d28eacc04e2c26eaddc7de608824f1910
AgentTesla
+ 10'924 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-dsk45khr9x/
Behaviour
Suspicious use of SendNotifyMessage
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe bff0771ae9dbc7078a6afdb9fd366c5f3464606897e2710f09240981fa57ff9f

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/16742/

Comments