MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 836aa9924c1cd4b7af7f1abdf47ca06cd9c420d6c3192fa671ec725d04d6ac6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 836aa9924c1cd4b7af7f1abdf47ca06cd9c420d6c3192fa671ec725d04d6ac6a
SHA3-384 hash: d787ebf978b5b684932b4bcf79312aa43f5b0929b90918583fa61106944184949dc6e41a398c40ee259d26b289bdba58
SHA1 hash: 8a9e9d32dd061bc7c64448b12e02b9fadbb49ed8
MD5 hash: 26fac04d9637efe659e0f9e91a8216aa
humanhash: triple-diet-red-oranges
File name:1defd88659fc311bbe61e78cea4bfdd9
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'624 bytes
First seen:2020-11-17 12:44:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cbf7fe79012900c30377bd73f609179 (3 x AgentTesla)
ssdeep 6144:ccLDHhkO/1TzRodA6uAOFWzkhFbM9sdvKAA0k5l2Y8wGuY0PO/zG3c9oLM3M:ccLD2OB2u+kI2oAv5wGuc7GM9L3M
Threatray 1'314 similar samples on MalwareBazaar
TLSH 0FA4012075E3C473C432043549E897B7A97E7D312F60D9AFB7A81B1A5E321D38626E63
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Creating a window
Using the Windows Management Instrumentation requests
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/836aa9924c1cd4b7af7f1abdf47ca06cd9c420d6c3192fa671ec725d04d6ac6a/
Threat name:
Win32.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:50:26 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0b0497a471a34be0ac2c4719719527d6a73b4a0ad0d7b8f43d9c9af5119ce9cd
AgentTesla
25c6ed88a34e97a0d1c4c8fa3d2c90a6b39345a56f0dbf5775bb2e4d2320415f
AgentTesla
33c6ab107de081461d6f7b67d5d120efc3dd15ba75351d9a564884d6368078fe
AgentTesla
8a21b943ea85a94fb89a4222be1b22222b71447cc16fe9b1ef58957029210a8f
AgentTesla
a261898485667823b47ab6885b0cd8c16d126bc0f1671dd7aeb9b675aa01aff0
AgentTesla
ba3548566c5eda9447bd910346549f92ecc5cd51f959f51cc7bc836a2ce49501
AgentTesla
c2df8e72382149481c403e6a2d52dbb93daeb046e8ce23247ec763f50490be96
AgentTesla
c8a8b43ec47c6c9831e275e2009ab58f7794374b4876fe72dbc4151296330aec
AgentTesla
d2adec41dcdb2142c210a4025572e29e1c011d079fa04504b35ab55c03376a16
AgentTesla
f06c40df7dde44469aa47985010736dbd83224df91951b9d55cdb7a377353a61
AgentTesla
+ 1'304 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-httwfgxcra/
Unpacked files
SH256 hash:
836aa9924c1cd4b7af7f1abdf47ca06cd9c420d6c3192fa671ec725d04d6ac6a
MD5 hash:
26fac04d9637efe659e0f9e91a8216aa
SHA1 hash:
8a9e9d32dd061bc7c64448b12e02b9fadbb49ed8
Link:
https://www.unpac.me/results/0e4d4810-9785-454c-b788-84eaaba225d7/
SH256 hash:
575916a8d9faf7dfa2183f786f32775eaa591ae749a57dfc707165c2b9d042a3
MD5 hash:
6339a463194e6307fbce792e9e6cbce0
SHA1 hash:
904ff9814469b952ca9367729845874c5cee9095
Link:
https://www.unpac.me/results/0e4d4810-9785-454c-b788-84eaaba225d7/
SH256 hash:
07b8ef62a6fe990d34ad9921dd08749fa07ff0b83e16d05824302b598d688c2d
MD5 hash:
23c3140a4c76f86167af2f83d897e33c
SHA1 hash:
9f0f9e55069659d008865a55c949ba7d96c94db3
Link:
https://www.unpac.me/results/0e4d4810-9785-454c-b788-84eaaba225d7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments