MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4aebd2918942c4d01076cd9cb47402c5b8c61e14e86a397488d1abc2e444d626. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4aebd2918942c4d01076cd9cb47402c5b8c61e14e86a397488d1abc2e444d626
SHA3-384 hash: 5355301ddfdf3179b48c0fae3d873262b4c057b14e0825af2e923a2d1056e3d8c64d73f62dd2932196aee19b9946794a
SHA1 hash: a339f9157aa377c24e344847302273f382e8ae05
MD5 hash: 88188c0026a914c3424d7fe0cc6ca717
humanhash: eleven-december-robin-hydrogen
File name:SecuriteInfo.com.Trojan.GenericKDZ.66979.14997.18501
Download: download sample
Signature AgentTesla
Create hunting rule
File size:20'480 bytes
First seen:2020-05-17 13:38:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 384:Jx90aaSX/XRVucWimoXIN8yvVGa2ISh9iFvc/KBCld75J:4cj+8keb/EAR
Threatray 74 similar samples on MalwareBazaar
TLSH 0592F76133EACB36DEBB873499B047C18730B3535513DB6B48C9609A46A37848B573EB
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.66979.14997.18501.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 21:25:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlv5femjilcnaedwzwoli5acyw4mmhqu5bvds5ei2gv4fzce2yta._file
Verdict:
malicious
Similar samples:
555f84812f700d1448fd200f04200ae9d17413652be94c54ba442fccdf9104dc
AgentTesla
642ecc0813761138cff276fdece24e479604dbc7c012a2a168d018330e1905e5
AgentTesla
701e2cddd4d1628c01c3ce13a20b5414726995565377e6ddc3133d1245a88cb4
AgentTesla
7310d9b87d90bb647879dd9a7adc8cb76e0630dca1e15e75abfd0083203e83a2
AgentTesla
87ff4257e145cb109c3a91260b9412e0bf13ab481ee0d2e592254f8dd77db458
AgentTesla
aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad
AgentTesla
c4a2c8397cfa4f7f16a317aad541b6c48e35c4420249f702b2c6f01faf66ef61
AgentTesla
c4e42ebfd487b325ece4f09d75687c96e252aa8559f8a8daad6336dc39ee5424
AgentTesla
d4bb66bd17508438be397f81e2226dd6e4814fcc09573aefec5039a7ec3b10a8
AgentTesla
e12bf1c4b6712d15cebf8556b8d659bc928c6ac18efbb081d56811bd48ce3359
AgentTesla
+ 64 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-qkjmhjr9mj/
Behaviour
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 4aebd2918942c4d01076cd9cb47402c5b8c61e14e86a397488d1abc2e444d626

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/363910/
  
Delivery method
Distributed via web download

Comments