MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 563e6477119bef47a23c756f2ef2e639185202e0109b98103eff58a2fb4a53ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 5
| SHA256 hash: | 563e6477119bef47a23c756f2ef2e639185202e0109b98103eff58a2fb4a53ad |
|---|---|
| SHA3-384 hash: | 1f90a11dba1698df1182908ac1619cec214d58f329ea730d91a08bc63a90c7239c2aa12782c9149cc114ccb45fe9b292 |
| SHA1 hash: | 7dac3e4d0e3a6a0972f525ba345ed21498f24c1e |
| MD5 hash: | 4b383f1308e0cce67cb5e485dea43db5 |
| humanhash: | happy-may-papa-lactose |
| File name: | PO 94.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 471'040 bytes |
| First seen: | 2020-05-06 08:08:27 UTC |
| Last seen: | 2020-05-06 09:09:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:VRPzqCX0HFFJfS7X8tb5mFV8HZ+2CsKPVT9qUu9O:VBqC2ronCZasK9ZqUq |
| Threatray | 3'351 similar samples on MalwareBazaar |
| TLSH | 4DA412AC7220B2DED88BC473EEE81C64E650B57B832F4247906711DEDA5DA83CF194E5 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing AgentTesla:HELO: TC1.tandaocommerce.com
Sending IP: 68.169.59.190
From: ArcelorMittal International <europe@arcelormittal.com>
Subject: Confirm Availability. Inq wada arcelomittal.
Attachment: PO 94 PDF.zip (contains "PO 94.exe")
AgentTesla SMTP exfil server:
smtp.yandex.ru:587
Intelligence
File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Status:
Malicious
First seen:
2020-05-06 03:07:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
27 of 31 (87.10%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 3'341 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.