MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8
SHA3-384 hash: 93a542aeef10062f4a38b2e416b1c6199afec286f4e7adcb28f36922459696c5fc89d7bbb7e9dca7bbc355c7f8d50f0f
SHA1 hash: 0251ce964edb8092fb0ceb01db4725ed01d48ef3
MD5 hash: 7773ffee8fdad233f1e375d29fbcf2b5
humanhash: spring-triple-oranges-alaska
File name:7773ffee8fdad233f1e375d29fbcf2b5.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'049'132 bytes
First seen:2023-04-05 13:14:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 24576:75J9jNthgymR6xMhWjpeB4+SVooXWAb8jdtX0PrDtVnHcMNrEOCxXC1lM:VhgymR6xMhEp6SKDdtX0PdV8MF9uy1lM
TLSH T1BF95D0797AAB9612D1BDDE32C9F69410A3F184077222E92F3EDE03C50613B9E18C759D
TrID 31.7% (.SCR) Windows screen saver (13097/50/3)
25.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.9% (.EXE) Win32 Executable (generic) (4505/5/1)
4.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/380326/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.55531.23515.10799.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/642d74599c8d0c3b7bcad03f/reports/5ca8308e-856e-4915-ab86-551ef53c8a1e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/286b8304-b330-4231-ab51-f6c839c4a449
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1209101
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkrvwnr4gvye7tzljaqattume2d7xy4wkqbz2zjftrznyetkqtua._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230405-qg8z7aeh46/
Unpacked files
SH256 hash:
2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8
MD5 hash:
7773ffee8fdad233f1e375d29fbcf2b5
SHA1 hash:
0251ce964edb8092fb0ceb01db4725ed01d48ef3
Link:
https://www.unpac.me/results/17c0c604-2e64-4921-8055-42c59258e481/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 2aa35b363c35704fcf2b482009ce8c2687fbe39654039d65259c72dc126a84e8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2536806/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/380326/

Comments