MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ff93944081c104e8175f5209255c50e92d65f8a3e35fbf01c5f6f46237575af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ff93944081c104e8175f5209255c50e92d65f8a3e35fbf01c5f6f46237575af
SHA3-384 hash: b0ccf67cd35c937a8414c2b917217a164176bf88fbc3bbd88b09fd0182aaf887c041ce9f37d9e4625874f18d2860a37b
SHA1 hash: d308082d60a244275b5ccc2d1a9b574ad4888ef4
MD5 hash: 939dc4da2e48a348f54a687373204fa0
humanhash: triple-crazy-monkey-undress
File name:109ef55bcd879e4685f6199590467109
Download: download sample
Signature AgentTesla
Create hunting rule
File size:960'512 bytes
First seen:2020-11-17 12:39:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'597 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:MCOkg9P7niTVemxXN22p5dgGbGUEFFCyo1M/qY6SbS9Wjy7AB/eU:gPWT195p/gQGTFFtoiyY6SzyExL
Threatray 1'338 similar samples on MalwareBazaar
TLSH BD15AF236B446B6FF0F4577F84E9580893E8DC82E31ACB647D993A8E8591FB2BD14113
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ff93944081c104e8175f5209255c50e92d65f8a3e35fbf01c5f6f46237575af/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:44:42 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f74tsraidqie5alv6uqjevofb2jnmx4khy27x4a4l5xumi3vowxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0a41900b78aa8ad61d42ee6cf76f4045093ea691d6a0e0ab6d535f6bb6ddb907
AgentTesla
19006e1934a36332207bb746cdfad53e5264682ed947d4f6c99debecefe12f99
AgentTesla
20dbea65f9ea5d713ead877a8fdca2bb606af820520ea99fafcef39fc7652ce2
AgentTesla
52a8719e0795679e8336c841ddc5f6b0a74b5e423c4b71fe0db3ddbfbc3f7e7a
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
97c73eb27f164d01020de5531c96adb305bfdd8e6ec727bfaf65a2fa7b02638a
AgentTesla
abf3d62c029da4a935ffde31a6559242200cc0b0483c0b552e714d54170407a6
AgentTesla
ace15b4d4120396673e1b09fc53278527fcb465235c2ad23403fd24d08ebd460
AgentTesla
d5a2e34a8816a75fe9d6cd9b9035040ea5777429dc7eeebc0ebb7f8a4d897495
AgentTesla
fdb7a6062629817446b0ca39ab05f73ecda6a5b145f416b3b485856e5052e7c1
AgentTesla
+ 1'328 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201117-9ka7ek255j/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Unpacked files
SH256 hash:
2ff93944081c104e8175f5209255c50e92d65f8a3e35fbf01c5f6f46237575af
MD5 hash:
939dc4da2e48a348f54a687373204fa0
SHA1 hash:
d308082d60a244275b5ccc2d1a9b574ad4888ef4
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
SH256 hash:
b9c36d31bd0640690634a8597b2eef1405403113fb68781a5d17596461b4c3f1
MD5 hash:
5f5e75f5d7c867fe06ff7f22aa890332
SHA1 hash:
c3669c480e9c2e79b9876a436c1a8cd481b91db4
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
SH256 hash:
a937ebe9755f7c7503c7fa409fc57acae451b8818814043c3a246f492fdc8364
MD5 hash:
d72bd145c516469e5fe0e8139d560859
SHA1 hash:
eb8aee039db6546bcae86464ec3aa55099950437
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
SH256 hash:
e1e2ca0c8de35330e215c3e5b5eb6bf9558937b3ff4b293e49e3b8b665ad4c68
MD5 hash:
ed85127d779a5dbe760768ff8510d7e2
SHA1 hash:
feb74ce0fd018ce52da4b286f80b7555b107720e
Link:
https://www.unpac.me/results/e85ded98-94c6-4f7d-8f79-7ee48171598d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments