MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300
SHA3-384 hash: fff65da6a32c603300c94c4acc9e41c410f4eab43ee20302e21e3f3972eeca0cfbb97980a4c19b8cc6378db730b67f64
SHA1 hash: ed95f94af84bd3ca3bad3ef57d20fdbad6925f06
MD5 hash: ef33f7a8cc10b0b8bc636eb8c751f85f
humanhash: eighteen-asparagus-golf-iowa
File name:ef33f7a8cc10b0b8bc636eb8c751f85f.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:724'992 bytes
First seen:2021-04-22 16:42:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:tLWHReF8RDszRRRRR3zzkmProNgD7mQOk4WCdIuwXWZ:648RURRRRR3zzVzkgnUklGyXWZ
TLSH 5EF4F01973D4581DC5AC1BB44EE1630A03B4AD121213E7D93AE371BAAD3E3DBDB2174A
Reporter abuse_ch
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
258
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ef33f7a8cc10b0b8bc636eb8c751f85f.exe
Verdict:
Suspicious activity
Analysis date:
2021-04-22 16:58:13 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/40d3886f-368c-4576-bb3b-bacb06438e1b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.677-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/693469
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-22 17:11:13 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4zt54h2tyzbbslqt2zjnrat37tgipvyxxw7t6fndwqo4mo2omaa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210422-ccbfephp96/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 87333ef0fa9e3210c9709eb296c413dfe6643eb8bdedf9f8ad1da0ee31da7300

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1148197/
  
Delivery method
Distributed via web download

Comments