MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3256574b14a63365fe83b15704cb49a4d44dc1cbef33bc839af2afa07902ed68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3256574b14a63365fe83b15704cb49a4d44dc1cbef33bc839af2afa07902ed68
SHA3-384 hash: 60274aa572bd2d32e5d7ea9bf9fc00184bd7fb826d461d45401e31d2446c42f836bd273905d5c8a87488532a748df0a2
SHA1 hash: 04f9d664f7548b3e1a58d50d82ae5a217d1f6e59
MD5 hash: e61660171e2201d9715664a22719d1a4
humanhash: nineteen-river-kentucky-network
File name:3256574b14a63365fe83b15704cb49a4d44dc1cbef33bc839af2afa07902ed68
Download: download sample
Signature AgentTesla
Create hunting rule
File size:765'440 bytes
First seen:2020-09-08 10:36:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b21a7468eedc66a1ef417421057d3157 (10 x AgentTesla, 10 x MassLogger, 3 x AZORult)
ssdeep 12288:yeGVla4LxkuayJ4uoqw3WCCkL5lOy/COaVUxAK2WOgAdo4Fa5:nGDh1aKoqw13WhVUSK0gAdC
TLSH BEF48D22BDC34833DDF3163D4F4B9E749829B9D229245B5A7BE8DD4C8F39251392908B
Reporter madjack_red
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/57848/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.34490256.31687.27024.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Sending a UDP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3256574b14a63365fe83b15704cb49a4d44dc1cbef33bc839af2afa07902ed68/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-08 02:25:29 UTC
AV detection:
45 of 48 (93.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjlfosyuuyzwl7udwflqjs2jutke3qol54z3za426kx2a6ic5vua._file
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
upx keylogger trojan stealer spyware family:agenttesla
Link:
https://tria.ge/reports/200908-mqyxbv4jzn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
UPX packed file
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/3256574b14a63365fe83b15704cb49a4d44dc1cbef33bc839af2afa07902ed68

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/57848/

Comments