MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a93c0c234ef03ddb2a04db9e4e908112a1b035a2bc38033d2e71af8eb90b697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a93c0c234ef03ddb2a04db9e4e908112a1b035a2bc38033d2e71af8eb90b697
SHA3-384 hash: eab1903b05c41c6b1a2f89b7e59a822aefbd359f78292190e01c741f3b74a289d5c70f62cc0f06f18fb07e75bcb02e80
SHA1 hash: a294e0c4f808fcf85cbfb85c916ce98f0e3f6859
MD5 hash: 1d44e897b6fed66d39bd9135d1661dbc
humanhash: zebra-west-diet-mississippi
File name:Company Profile.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:900'096 bytes
First seen:2020-09-08 13:35:00 UTC
Last seen:2020-09-08 14:48:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:txC2hrrSBTjAa4nc9PDj2oz1GTdv8Bdpkww0Qixr8FmQ72jnrGv6nnjqKoe:ts2R/azPWoMuBdc0QOr6KC6nnjqKoe
TLSH 8C15D0933A448A98DE3D57F66213815423EADCBFC314D6097FC833979EE5B920921B1B
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV2
Create hunting rule
Link:
https://www.capesandbox.com/analysis/57921/
Detection(s):
SecuriteInfo.com.Trojan.Inject3.56709.20729.19327.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a93c0c234ef03ddb2a04db9e4e908112a1b035a2bc38033d2e71af8eb90b697/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-07 23:05:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkj4bqru54b53mvajw46j2iicevbwa22fpbyam6s44npr24qw2lq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/200908-42zyd2t8ss/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a93c0c234ef03ddb2a04db9e4e908112a1b035a2bc38033d2e71af8eb90b697

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/57921/

Comments