MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 38025fc17a575c25042524cf59381b44c8256b673d2a754418e579139b6ba893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | 38025fc17a575c25042524cf59381b44c8256b673d2a754418e579139b6ba893 |
|---|---|
| SHA3-384 hash: | 15047f196e9a65dbcd72bd7769209be019fefa09d0a88aa5a92df9a1b4e575b7969bce0a07110ab3a36a6faf89b6f993 |
| SHA1 hash: | 222baf84fe89b1d9c9d0b8be58bf073439fafe94 |
| MD5 hash: | 35917414b32dc5c3f13d65242524cef5 |
| humanhash: | virginia-white-sink-helium |
| File name: | 8d778d91e67911cb206ffa6939302650 |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 1'007'616 bytes |
| First seen: | 2020-11-17 12:38:45 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'450 x Formbook, 12'201 x SnakeKeylogger) |
| ssdeep | 24576:i1QMZY3YgjNgWHfdkQCq+z+S+HED6meyEfu:GpY3zPAh+kD9E |
| Threatray | 10'183 similar samples on MalwareBazaar |
| TLSH | C025BE255301AB1EE43443B760687815EBF9DE82C322EF9A7CF93DDD9AA5FA1D910043 |
| Reporter |  seifreed |
| Tags: | AgentTesla |
Intelligence
File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-11-17 12:44:17 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 10'173 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
38025fc17a575c25042524cf59381b44c8256b673d2a754418e579139b6ba893
MD5 hash:
35917414b32dc5c3f13d65242524cef5
SHA1 hash:
222baf84fe89b1d9c9d0b8be58bf073439fafe94
SH256 hash:
c8671a87d685f2354d96f3cfcad530dfa5f3ec535a0f5ec14940d81fb857813b
MD5 hash:
b5358f677850210361f573c7d249c258
SHA1 hash:
215e06e319515d779efa88f7c05b343d6ec3f6a5
SH256 hash:
1b70dd2fc5c7ea2ddd02a85a089ce42c3efc66e757061b53cbf6b8967c1cc3dd
MD5 hash:
67c77552ef5856c74dd4513c793cce2f
SHA1 hash:
3cdb9cdf80d0a9aab59f811501fafda460b23537
SH256 hash:
c6fcf5d515d56cf746b4c4aa4695f11e9ad7f6063a96cda810bf39dc47c5a7a0
MD5 hash:
47509d9db24c975e55c287afdc459fad
SHA1 hash:
4f1f893555c985d7cbba731cf1fdbf49c6ecf793
SH256 hash:
a73b837d58b84e2deca8333cae31dbf0a446bb250f0439447ee4d1a4aca9cdec
MD5 hash:
cb629ca5bee41490a9b7d5c28666c47a
SHA1 hash:
5221bfb64c933c885f0f8297b51e4f89787faa49
Detections:
win_agent_tesla_w1
SH256 hash:
e9a332e7a6c90f4803a941e54da49d73ce79c824cff869aff57db4c64b13dd79
MD5 hash:
ea22fd3c91745aa28be399c7c2eca105
SHA1 hash:
efa2c6c2aeeb53656aa92b56e1ecaee7280e4dd2
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AgentTesla_extracted_bin |
|---|---|
| Author: | James_inthe_box |
| Description: | AgentTesla extracted |
| Rule name: | AgentTesla_mod_tough_bin |
|---|---|
| Author: | James_inthe_box |
| Reference: | https://app.any.run/tasks/3b5d409c-978b-4a95-a5f1-399f0216873d/ |
| Rule name: | Agenttesla_type2 |
|---|---|
| Author: | JPCERT/CC Incident Response Group |
| Description: | detect Agenttesla in memory |
| Reference: | internal research |
| Rule name: | agent_tesla_2019 |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | CAP_HookExKeylogger |
|---|---|
| Author: | Brian C. Bell -- @biebsmalwareguy |
| Reference: | https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar |
| Rule name: | MALWARE_Win_AgentTeslaV2 |
|---|---|
| Author: | ditekshen |
| Description: | AgenetTesla Type 2 Keylogger payload |
| Rule name: | win_agent_tesla_w1 |
|---|---|
| Author: | govcert_ch |
| Description: | Detect Agent Tesla based on common .NET code sequences |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.