MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 305324e2931f477a0fda50fa6d98ff3d7a70919e07e593fbd505d9a6958e67c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 305324e2931f477a0fda50fa6d98ff3d7a70919e07e593fbd505d9a6958e67c9
SHA3-384 hash: 7519d0f29f10f02c19cae427a03c4e75f4d5612ac3136e593d147f14e98b1d53c29011e0018f57cb4a3d316fecc6b9c6
SHA1 hash: b853416eead1e474cd9933c3350b0c5be1573c13
MD5 hash: 82dd0b932fd4b9a9460ad1db561635e6
humanhash: berlin-fix-mobile-bravo
File name:ORDER INQUIRY.scr.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'752 bytes
First seen:2020-06-12 16:52:52 UTC
Last seen:2020-06-12 17:36:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:2pknieagJKng8aGMy0JxIodbdYS0e0uvx7PE0AlNYeRr+PJvhOnq1D/l0:2UKg8bMy0Mub8WQZYGr2hO
Threatray 8 similar samples on MalwareBazaar
TLSH 1784128933F42321D77BD7F52EA6E4440BB6542B8862CE0E5CE8D0C61D33B625C59E6B
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/7988/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.7020.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 16:52:23 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gbjsjyutd5dxud62kd5g3gh7hv5hbem6a7szh66vaxm2nfmom7eq._file
Verdict:
unknown
Similar samples:
0159364dc4a13deea8595d019b3c1e44ca100690b3d7f2df7d79cfd86d4b36ce
AgentTesla
0c80fa8807477cff8c9c3ed7b2a857538f022b1e8829020d09f60bd71f1afd9a
AgentTesla
3ee04e378f6430e85f5756093e80b243c2ebbcb9f2ee77cc32acd1cd9e333301
AgentTesla
4227b2c2e57cce8f1b8261a41d08d3a2f98e5034d9a14a11c376a520fb8ed284
AgentTesla
568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
AgentTesla
b0d9f78957650a0bc42b0bf646e3d158f713de64ee5e6ab395cf777e93a7a240
AgentTesla
baf5ce2b3e5d66b8a28c683d08d99fbc8d9bffa92a18a9ba2b07a90a04300314
AgentTesla
dd11381223ab1902db2963df4cbe3299e42064a5857545560f913647c1f70c5a
AgentTesla
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-n35qaxb236/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/7988/

Comments