MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fdeff12a76654fa755bc975b5727280884ee49ce3881411b1769bbdc75688cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: 1fdeff12a76654fa755bc975b5727280884ee49ce3881411b1769bbdc75688cf
SHA1 hash: f9799efbcad46e9a810fc2c33dcd2d79e19223c8
MD5 hash: c43a2b75c6f346bb5c10de52dc0f5f57
File name:favohhed.exe
Download: download sample
Signature AgentTesla
File size:1'480'192 bytes
First seen:2020-05-22 13:37:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091
ssdeep 24576:1tb20pkaCqT5TBWgNQ7aCtviVjcvQsY0nbLX5zoN01iRERxqesTB+c6A:mVg5tQ7aCNiVjcvdLN0Ni+N5
TLSH 3465CE1363DD8260C37E51737A167701AEBB782936A1FCFB2FD4093CA9201215E5A66F
Reporter @abuse_ch
Tags:AgentTesla exe

Malspam distributing AgentTesla:

Sending IP:
Subject: Order14697
Attachment: PDF_437953793264.IMG (contains "favohhed.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
DE Germany Low
Global Low
# of uploads 1
# of downloads 25
Origin country US US
ClamAV Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
VirusTotal:Virustotal results 30.14%

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 1fdeff12a76654fa755bc975b5727280884ee49ce3881411b1769bbdc75688cf

(this sample)

Delivery method
Distributed via e-mail attachment