MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
SHA3-384 hash: 5730f12e7fb8febeaf3cbbc2ab74807e03cfbb73ed7982c0b94d26bb5901f366b63865e2f11f8424243bb7d943c48fda
SHA1 hash: fc55c317c0fccfffbc0eeaba59e4da25bce12840
MD5 hash: cf23f437cd48cf46d6d823f43e4506eb
humanhash: oklahoma-july-tennessee-gee
File name:17926650602379a9175719074159e552
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'567'744 bytes
First seen:2020-11-17 12:47:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'636 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 24576:Krwh1m67/bgnvXg4v0vsUWra2xPgbaDigu:qQz0fNv00UW7+2Dih
Threatray 1'314 similar samples on MalwareBazaar
TLSH C475E69D3260B6EFC857CD36DA681C24EBA074BA830BE243A05716ED9D4D59BCF144F2
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Fileinfectorx-9794615-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:51:39 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnucsjqtwaswsa7e6luyqe7y6k5tkiyx4etkuddc2jhyctdeeesq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
05edc3fe4fb4bfa22e5e3ce66e66a4f258adc1aebbb26142bafd1a9264feb4b9
AgentTesla
19006e1934a36332207bb746cdfad53e5264682ed947d4f6c99debecefe12f99
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
642dfced9844802f4388b3c2f30e08d9a1c94f2507e7277d900756b284d37ca1
AgentTesla
6b75182568a1cf2fef851977be460536fe4a0af4aaf05b41a253c53f2af276fc
AgentTesla
a97528499bee868023a6898c85da34f9ed73a5a12b8a3a01817a88d82a8c5641
AgentTesla
b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
AgentTesla
c754f76eefb0ac8ba7da335bbdc3e50ce786a331f41056215367418fca46c1a5
AgentTesla
e4a41177193fe8cd0c6113402e16b6be355a08baed17e525019ff02ffd8884a8
AgentTesla
f39b3fc42fd8089d99eae4cb1ecead6e3d772007d766c1f982ab1834af68dc00
AgentTesla
+ 1'304 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-xtjnx5mfzj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
MD5 hash:
cf23f437cd48cf46d6d823f43e4506eb
SHA1 hash:
fc55c317c0fccfffbc0eeaba59e4da25bce12840
Link:
https://www.unpac.me/results/9f7327bb-2eba-4300-9311-4c5024d884a8/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/9f7327bb-2eba-4300-9311-4c5024d884a8/
SH256 hash:
012e5bca3dfdf85e84278d5359eee4a15e0d5bdb747c3785ed7be731725979cc
MD5 hash:
e366900ab55c097217cfe947580b60a2
SHA1 hash:
4cdc447afdb8d27a715e9008d212e35ff1d25026
Link:
https://www.unpac.me/results/9f7327bb-2eba-4300-9311-4c5024d884a8/
SH256 hash:
83af658e2f6c8618722d46228a7a2432db07d8d553623e836b709049fe174ce3
MD5 hash:
116002365eacc9ef8255033c32d32783
SHA1 hash:
ad5652525033f5925aae0c0923fb0115b42a9f74
Link:
https://www.unpac.me/results/9f7327bb-2eba-4300-9311-4c5024d884a8/
SH256 hash:
f5d7062e804eaa009f8745ed33a89a4e5ab58904b038fae32595e88d75c7cc47
MD5 hash:
fc636710e3a3a6bdc6d49fc8ee01bb04
SHA1 hash:
b1b665c8defe6844613a37bfc6e2f5d529a0b06d
Link:
https://www.unpac.me/results/9f7327bb-2eba-4300-9311-4c5024d884a8/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments