MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1
SHA3-384 hash: 5678f023d75bd2ea5381796981dcfafa6d88d316d1689546f790dc33bb2a81bad3a9fb85cf79379510763e435af4c301
SHA1 hash: d54f135d12070d48a4d02926a0483ad02b7f4b48
MD5 hash: 562edb9dc3aa52dac5a4ec8a4dec4d99
humanhash: zebra-black-artist-oranges
File name:OSOC.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'072 bytes
First seen:2020-04-30 10:57:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:4cax98A2K4ZrJokQFyzYKi35ELKKpU5yebQ86w6In9Wsx7WXDtx4WnIA/0hC0mLM:4wAra3LKFf9wzHznIyVfLkb9E
Threatray 28 similar samples on MalwareBazaar
TLSH 3CA412224E688637CC7C1BFB85E323009776A3DB7971D3694D89A8851DA3F506A607CF
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.43526.838.29199.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 11:18:12 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncp3bukbtozqcc5sqd6lsesjghhxqcx6z2y7frcv2fdmic56wsqq._file
Verdict:
malicious
Similar samples:
0af44b9553823391f942810e491b2160386c70982d0ee3e5ab745ae161f7572d
AgentTesla
1da6d8cdbcbc126bb0e5f21e8e4678fccd0e5ada916a304ba48c473a3e674666
AgentTesla
1dc7b9bc7fc4e17e45e76dfb99d0106802a503fcadbe1669a0fff3499a55eade
AgentTesla
274402fb25f2eef022a8c983908731a36aeddfe2f547057ea6c2e172a8523891
AgentTesla
48fce5283ce4cc7338411ae3d2b3d4c9dbd6d522f2f8ccfc63c2705e007364fe
AgentTesla
6f638140923eb201b19d8f2be1c73e16294a06e2ee21cb2b74099416380f4907
AgentTesla
7af2440f0716f18f1d20faee99d68c25bc6e4a3eff067e759d2167aa5211221c
AgentTesla
c599667585688c32aa84ecbdad1a01e93e4a92beeab76c48f1f415234ce26b6c
AgentTesla
d36325c4e5d94107b550c1bea0edb4f5e6854f83ee11294685a337af71683f6a
AgentTesla
f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be
AgentTesla
+ 18 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments