MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9
SHA3-384 hash: e348732093b90caf8bfcb4da70869a3d06aa02bdc8b9308bd9042f87a2e8fc8b6a03e3fc34ee85b30849111ace3476c8
SHA1 hash: 729c3c5bdf11ba69d318877a16585f09b77fc0f2
MD5 hash: 25ea25cc15812c15d660009915d21bf7
humanhash: fourteen-fix-tango-pip
File name:25ea25cc15812c15d660009915d21bf7
Download: download sample
Signature AgentTesla
Create hunting rule
File size:891'392 bytes
First seen:2020-11-17 11:44:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 24576:UibXXvXgerComGJsLwBPyuVjuXHCx+3d3i:UibHfgHOs0BPljuXix+hi
Threatray 1'376 similar samples on MalwareBazaar
TLSH 12158E4213F49B88E13E6B7AD570421457F564418B37D7ADAFD020EA0EAA782DB1F34B
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Fileinfectorx-9794615-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 13:24:23 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=omtn3x2yohm6ukurwbuykj5ygc5ydhujt47ovp45i25u2hdnbl4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0c316b6e9b1bb80efe9a27b513c7c091cd047d5bf437b88db13f8e45a40e89d6
AgentTesla
222af506bee8af177dc09a2f709208725bf5823f145fd9f5b10340e203f402da
AgentTesla
2a2cdfecba906f227e37060568e74abcecd85612c7f717522d75b59937a3a691
AgentTesla
2b68292613b0256903e4f2e98813f8f2bb352317e126aa0c62d24f814c642125
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
642dfced9844802f4388b3c2f30e08d9a1c94f2507e7277d900756b284d37ca1
AgentTesla
7a8f3ee787e2954f90419c96cb23fba73c3fddbf980fb4fc4bf239a17244fbe7
AgentTesla
8bcb63b65e1e1169e4212f656871db5fd33e5a8cffded5009b74471bb40f5b51
AgentTesla
9faaaef82bb4be60e65e7182bf8015d2a25fb7b2cecf59f0573f36fcc8635eeb
AgentTesla
e4a41177193fe8cd0c6113402e16b6be355a08baed17e525019ff02ffd8884a8
AgentTesla
+ 1'366 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9
MD5 hash:
25ea25cc15812c15d660009915d21bf7
SHA1 hash:
729c3c5bdf11ba69d318877a16585f09b77fc0f2
Link:
https://www.unpac.me/results/f3de6755-3df6-4b6c-ac05-97ca98654246/
SH256 hash:
9852507640e4515d9ade9c64c9c8f148b11a65212c7c6ee45c99df58de8be9d8
MD5 hash:
06b88d884496bed2a0c6a443d6ad4682
SHA1 hash:
0e2e9b549d28b5fd022e50babd162416f7f46b81
Link:
https://www.unpac.me/results/f3de6755-3df6-4b6c-ac05-97ca98654246/
SH256 hash:
51449778b90731550f21722c1efc8ba1efb62aeeaeabb7518a6fb20cd9f33761
MD5 hash:
4c9b16d938891b84f9b40ce9b4304015
SHA1 hash:
8d18547e3472861657e3cdbc09510f15d1b86fde
Link:
https://www.unpac.me/results/f3de6755-3df6-4b6c-ac05-97ca98654246/
SH256 hash:
13a1f305eaf76a5722824b8b16613acf808601358aef4226744225dfaf18270c
MD5 hash:
44c6f7f6e51fd49db5079cd53339e78d
SHA1 hash:
c968df6d821e4b5525d553e4590c4d9a77e451da
Link:
https://www.unpac.me/results/f3de6755-3df6-4b6c-ac05-97ca98654246/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/f3de6755-3df6-4b6c-ac05-97ca98654246/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments