MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ea011e6a1836355936582525e455b151057c89b7f1780ab52c6f5c4cb19ddad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ea011e6a1836355936582525e455b151057c89b7f1780ab52c6f5c4cb19ddad
SHA3-384 hash: f13edb8aa795e39af80f374fe6c0d654a93c6977c9bf498d72a76f4555ae752056fbb055d21ecb3b481d2f33c3777d04
SHA1 hash: f13959feaa99c330b3bd698c3d6467b9ed14efe0
MD5 hash: 8ba8df58c71457ca51ef371d4ecb2fdb
humanhash: crazy-kitten-grey-april
File name:SecuriteInfo.com.MSIL.Kryptik.VKQ.29823
Download: download sample
Signature AgentTesla
Create hunting rule
File size:591'872 bytes
First seen:2020-04-13 13:36:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:xnLaNQbK1U1FMowglK5HwhO0elcOoK8GaBDENrDGGe:xnL4r1OF/w3HwHG4+rDO
Threatray 258 similar samples on MalwareBazaar
TLSH C7C49E563689DE90FBE28A3D8D0CE511465CFE984A8AF36F348DBB6EB53132150B01DD
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VKQ.29823.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-13 12:13:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2qbdzvbqnrvle3fqjjf4rk3cuifpse3p4lybk2sy324jsyz3wwq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
123765ca93c6c71f123934f0a1ea08487449d2bfab58f47f9c0a2d4cc645021b
AgentTesla
2149d167c87cf15f48aa1852adcf96c9a62287a26496ff33892ecc67500d3be2
AgentTesla
4fd96327aca2d44216adea947c36d2913c82929fc2c124750322f13ae99262ba
AgentTesla
55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f
AgentTesla
8247e9152d0b43ffa80b4c82843bb0903043841c8b9c855ff312461f6443faf4
AgentTesla
9b915d2e5f70b859d8c2eafc94bd593d3e53255444a5b4b651dfb9c2523d83d7
AgentTesla
a14dc3eb54f3876b3a2bfc6e0aa105c832fc5424130c43248995cceda6790133
AgentTesla
c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c
AgentTesla
eed41a2c1215d2ca0ef2022172504a565b7a968e6263e173fceb6f1b1747d795
AgentTesla
f2a6395f3ae63cfeb7a50854bd0de43748013309a7871f3c114711fa0867c8ce
AgentTesla
+ 248 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 6ea011e6a1836355936582525e455b151057c89b7f1780ab52c6f5c4cb19ddad

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/339464/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments