MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c4f41d645657a8be7da399765e00d1d7e170fc6d7114e14fff1c8d717fbca16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c4f41d645657a8be7da399765e00d1d7e170fc6d7114e14fff1c8d717fbca16
SHA3-384 hash: 00eae02f270c6dcb74d81ba05f522672cf201874a0daee1f1cc91db26bdf876c6a241fe575991d5660cb9cd59a52b1b8
SHA1 hash: dab911e9cf11ed49ca017fa5b95c6df5c876775f
MD5 hash: 8375c6259b12cb3d1daf0b18ebf8c16c
humanhash: charlie-apart-eighteen-carolina
File name:PI No. 06-2020.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'680 bytes
First seen:2020-05-09 21:35:23 UTC
Last seen:2020-05-09 22:41:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:n7ecZ3g+W+cA6H5cNLcUhKmC57MWVVeKSa2tIof/nnPBvO1rGLzy5QLJoCN7hgU:Lg6f6ZB4c7PPhONfHBvOZKzeQd3BCU
Threatray 82 similar samples on MalwareBazaar
TLSH C9A4E06536ED1275F13AABB129E4E0A2CB7AB6177874E36E4D5204CA07D5F14CC20F3A
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.8375c6259b12cb3d.26233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-09 22:35:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=frhudvsfmv5ixz62hglwlyandv7bod6g24iu4fh76henof73zila._file
Verdict:
unknown
Similar samples:
2313dde5b84de43d82c693ccd65fdc2efd1321cc0ea3d8c901094805935eb0f1
AgentTesla
32be2a03798fc3f48f0e3d6d3002d26a41303dd85da97a3cebf496b07128d47b
AgentTesla
5658cd8df938fe8e0080829aa2696fb738b4323377f6fd193c38304147db561f
AgentTesla
6b235250a63f86521d4563354e9786a23393e39b634567c1f59a90f232c35027
AgentTesla
793666eca93a68eaa6cbb34eac888c354c61cc5d92e5f8d99466020a430308b2
AgentTesla
c01f7d088bbf081d5505e9356a6e1635eed13c9e8f8baef38f7a47c471067da2
AgentTesla
cb70c14b7aa724c2d1cf6881f0a864897d953c367ddbc002594da76941ac376a
AgentTesla
d2a2ddc131a6df1fdb8d1372cc6d46cc693ea3e6121a6a9d26d24c4310c9fc9c
AgentTesla
e04ef092d8d3adad8c3f032de54a73451febc7af434e87e87aaba75cc3a1914a
AgentTesla
f4e44a53a69291a3e254cc11fcf4dbe244f407cff4d919526a2532c65654ad89
AgentTesla
+ 72 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/201109-edmss6nw86/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e1907e4c4085eff77807873c4a7b367a25ff25fa729bf4972aa466c713eaa1a

AgentTesla

Executable exe 2c4f41d645657a8be7da399765e00d1d7e170fc6d7114e14fff1c8d717fbca16

(this sample)

  
Dropped by
MD5 be51bcccafc3f1ab036e37a46ccef96b
  
Dropped by
SHA256 6e1907e4c4085eff77807873c4a7b367a25ff25fa729bf4972aa466c713eaa1a
  
Delivery method
Distributed via e-mail attachment

Comments