MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a527950d894197b2f050718da8829767a02eafa306f6b8b6e10c99ddbf66125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a527950d894197b2f050718da8829767a02eafa306f6b8b6e10c99ddbf66125
SHA3-384 hash: f22d063144db5f2c5ffc5b1d17f9cb58c5057f3e36a11f7655cc2a92269d2ac4f690706c9f3f8eaca79c35b557dde0f1
SHA1 hash: 91c79ca87d0b2eb85808ba1087e3f8078e57f065
MD5 hash: e074b9dbd9fba48530bd4df07f9d1032
humanhash: avocado-east-sweet-fifteen
File name:5a527950d894197b2f050718da8829767a02eafa306f6b8b6e10c99ddbf66125
Download: download sample
Signature AgentTesla
Create hunting rule
File size:16'777'216 bytes
First seen:2020-11-12 14:27:47 UTC
Last seen:2024-07-24 14:44:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b6fd9945877b7e9d67b9e475c6d6ddf (16 x AgentTesla, 15 x AsyncRAT, 10 x Formbook)
ssdeep 6144:/5tOBJhwg2bgfBUpPsfWVnVAOm/Ge0mn6XtoDCfhTeWenc1Pr/IuUFcfK2m:/5tOBnwgzBz6VwUdoybec1Przr6
Threatray 1'073 similar samples on MalwareBazaar
TLSH 68F6F105B5D2C433D4B900340AD88B27C87579311BA5A4FFFB981F2E5E786D29772A2B
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a527950d894197b2f050718da8829767a02eafa306f6b8b6e10c99ddbf66125/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:30:51 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljjhsugysqmxwlyfa4mnvcbjoz5af2x2gbxwxc3ocdez3w7wmesq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
08f9ff6bbe01d3fab54974c872fbdf2f8fa1fd1f32649c776f0626030169272c
AgentTesla
320cad5692bb7d085732786b1823aac9c24aed4a2d1132763d3541f90380708e
AgentTesla
4fcb20f32c0c827e9f3977a2874dd0acc7163dedcddf56004e03a38a53d720f9
AgentTesla
5489bee07301a4d59ea4210dd7c5efd6030feb57a6ede6a9d670d21340c6746c
AgentTesla
554572aa51eb6a3ab4e1bb61511102574ab1bf2964560e5f7463120c368ff30a
AgentTesla
6f175e5ca3aed259ec1288d9dbd2510bff46dd383f95c07d9495570699934445
AgentTesla
a7df178348dd3563a0a0a44ec82af4b6bc15bf352337ef690fac078cfee6ec49
AgentTesla
acef7155f56a1434770c602a92ebf4945474ad85e9382df19ff5d3ffee461423
AgentTesla
e064cd70ae6467ad9c0342b4750cae4fb688c56b0d904ea4091aa074e174dcf0
AgentTesla
fb1c77156c32d3643f2b21550110a48c3bbf869d2f0aa099b7400646e1fcaeb5
AgentTesla
+ 1'063 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201112-zgqj6tc2dx/
Unpacked files
SH256 hash:
5a527950d894197b2f050718da8829767a02eafa306f6b8b6e10c99ddbf66125
MD5 hash:
e074b9dbd9fba48530bd4df07f9d1032
SHA1 hash:
91c79ca87d0b2eb85808ba1087e3f8078e57f065
Link:
https://www.unpac.me/results/24af34de-e371-468d-9e44-037f26c4ad7b/
SH256 hash:
63ff94cf8702ece59b5d86b389f1bb611d4db65452857ca19c819b6c22c8c444
MD5 hash:
796637fa8656f02782a68a7edae7a96e
SHA1 hash:
8e8486734d3fbb3527f9a78401fb6d0e290da37c
Link:
https://www.unpac.me/results/24af34de-e371-468d-9e44-037f26c4ad7b/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments