MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f6ab91e876a548f6434c6be14fa607768a597430b226d586cf428da94ab931c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f6ab91e876a548f6434c6be14fa607768a597430b226d586cf428da94ab931c
SHA3-384 hash: adc0af212dba6f45234fbe21d47296b6b2ef888ae084986edad46ce9e6a1bf0374c0d9eb5254063be7b1e26b204345f8
SHA1 hash: 0351f636bf18a144c481742a396365844b05cb71
MD5 hash: d9a57e4b3be9e902c26f32ed8baa4e4d
humanhash: white-speaker-angel-ten
File name:0f6ab91e876a548f6434c6be14fa607768a597430b226d586cf428da94ab931c
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'160 bytes
First seen:2020-06-29 07:26:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:UZgxiyN82kGor4Pmrs78wS4561XLycUc27qO/q4Zh59qx2YwNaS:UZe7x5Pm4/S4452FViYYwNaS
Threatray 585 similar samples on MalwareBazaar
TLSH A19402273A47C7A2CB189079C4DB622003F2AFC79773451E3B4D369D1EA73938E69949
Reporter JAMESWT_WT
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15619/
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f6ab91e876a548f6434c6be14fa607768a597430b226d586cf428da94ab931c/
Threat name:
ByteCode-MSIL.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2020-06-27 05:19:04 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
071fb094c702a43057a4f81b60030352529249fb796780b00bdbbe2fb4316876
AgentTesla
17c38ccce635b7567fb09e4e48c53b5661bdd29e827917a447f0de7741694d71
AgentTesla
1c4c55d54ade2d944fd18ed704c01bf9e3e62dabdaa54ee7871794ba9565bf28
AgentTesla
277bc43d33a51eed72dd34cb154885d184538331cf812fa8276facb5ee2b9e0f
AgentTesla
37b2228868b961b5d3c37d001a09de919aefe488440d06d12c617ad6e72c79c9
AgentTesla
582a065ea88a6240e88f101004a754ecc4b82d4ee43f76938c0b4081a9e08f2e
AgentTesla
5f0f76108593d7ecc8a5932e244c0168947b173bf24369ced9793f9a034d04c5
AgentTesla
867eb496d9f6122024560c00e0a2fde238fed90558dd0b4b838047c8eed8196c
AgentTesla
c2e6a6a4dcceeb65c2b769b92223c4b5c6de325709146391a4863dd56f4eb3d1
AgentTesla
d9edf42affd4dae1e5c0260eb6095e8ea3f03812e2479820dc6a41183adbe827
AgentTesla
+ 575 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-hqc6m2g5js/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15619/

Comments