MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c427eecac42b570d44d1f9deec2f9773fbf2893acfd269a458651339006cc71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: 2c427eecac42b570d44d1f9deec2f9773fbf2893acfd269a458651339006cc71
SHA1 hash: 7fb3a43a4aa62b5c61bd5ee8346e960b10b329e3
MD5 hash: 5aa3bf29df7b665895e6e6d1fc736249
File name:INV001.exe
Download: download sample
Signature AgentTesla
File size:446'976 bytes
First seen:2020-05-22 10:11:18 UTC
Last seen:2020-05-22 10:51:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:Yd9FNgvMLt5BE7JQF7yn2S96z4qI+tf0+2AGB4R4x167h:Y9N3LtX1y22/R+N0
TLSH 49948E7D76A4319FC86BC331DAC80C26A9A07427632B9D1A5493139D960F6C7FE901BF
Reporter @abuse_ch
Tags:AgentTesla exe

Malspam distributing AgentTesla:

Sending IP:
From: John Wallace<>
Reply-To: <>
Subject: New Order Request
Attachment: INV001.rar (contains "INV001.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 23
Origin country US US
VirusTotal:Virustotal results 27.40%

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 2c427eecac42b570d44d1f9deec2f9773fbf2893acfd269a458651339006cc71

(this sample)

Delivery method
Distributed via e-mail attachment