MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 755757fe45ca7ec3347803cad3da8e3d964c330f4649e014b22d6851c7acc5ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 2 Yara 3 Comments

SHA256 hash: 755757fe45ca7ec3347803cad3da8e3d964c330f4649e014b22d6851c7acc5ef
SHA1 hash: 5fbc9db39fe8992ffdb0658fb741b78e016ba2ff
MD5 hash: 867bba7bc56cb24399c876d3bac2ca68
File name:doc_091.pdf.exe
Download: download sample
Signature AgentTesla
File size:470'528 bytes
First seen:2020-05-22 13:58:20 UTC
Last seen:2020-05-22 15:01:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:ie+TIvTjKsDPW6guNtGG95FrqL5sEz4eWt:v+qTvDewSL5sEG
TLSH 0AA4F14AE2E4A71ED03F47F5A09A501013B1AF26926FD32D4FF270C951B77E18A61E1B
Reporter @abuse_ch
Tags:AgentTesla exe

Malspam distributing AgentTesla:

Sending IP:
From: SELINT s.r.l <>
Subject: SELINT s.r.l Order; Our customers need your products soon.
Attachment: doc_091.pdf.gz (contains "doc_091.pdf.exe")

AgentTesla SMTP exfil server:


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 28
Origin country FR FR
VirusTotal:Virustotal results 34.25%

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.



Executable exe 755757fe45ca7ec3347803cad3da8e3d964c330f4649e014b22d6851c7acc5ef

(this sample)

Dropped by
MD5 f9f91bc1622008cae1d272dcd37a9ab4
Delivery method
Distributed via e-mail attachment