MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d179277dc17521d3f9668838ddc6cfe818f72ef5691c123443b9442295d90ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d179277dc17521d3f9668838ddc6cfe818f72ef5691c123443b9442295d90ff
SHA3-384 hash: 590bae4502e54d116a06001390ec48fc1ff349d419451fd46965df441a87abe939b06ddf195323fc5c110d773ef73407
SHA1 hash: 6079d167c2afa9d6b2ee05b66cc578379ced1ce2
MD5 hash: e13afc1524674d854b84f3349da3cacc
humanhash: lithium-maine-queen-potato
File name:SecuriteInfo.com.Variant.Razy.672837.16788.30059
Download: download sample
Signature AgentTesla
Create hunting rule
File size:680'960 bytes
First seen:2020-06-01 05:33:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:7YiICCoPb7MIyhtPEtXbbJzFVR1dwbN9TcSa21lHB:7rPsIybEtXZzdQvj1P
Threatray 132 similar samples on MalwareBazaar
TLSH AFE4AE0673419B02E3AA5F39C1D745285BB2D5836736F34F6E9822CDEE012B95E43BC6
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.672837.16788.30059.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 02:20:11 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bulze564c5jb2p4wncby3xdm72ay64xpk2i4ci2ehokeekk5sd7q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
066752bd623ba4401c4f223b1d7d3367095632159cf758327e6fe7025d5d9a3c
AgentTesla
23b916e5bb30f814e9819cf3499fe56820380b827b20f595022eabbd47267374
AgentTesla
686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b
AgentTesla
723080f3083b8428248cead3d4c3ad20883395e1d574f853bca15065d2217fad
AgentTesla
82f9d45ee92a5f51af44dc11384e5a10fa12fbb46659291dc188a9222d17fc34
AgentTesla
cb8cf6b203f27f3b42020653f940d2be826893d079035eac52d4d64e1102aa29
AgentTesla
cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe
AgentTesla
dbeb99d2b3f5ab13560c96f80ee6153f909f64aac45d4ad56e2468320430acd3
AgentTesla
e874283490ec44e6cad0729867ee2441d0eb80d76b615455babebc7f5d4ec452
AgentTesla
fe3e525b56aaa99c9716eb9a4b7a1884e8b1f35d38388268f627485532f25d60
AgentTesla
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-48vgjx457e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 0d179277dc17521d3f9668838ddc6cfe818f72ef5691c123443b9442295d90ff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/373014/
  
Delivery method
Distributed via web download

Comments