MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88f6ff5e62731ae2b47623b51c1fc2a5e259cd5f28a54465e98ef240aa1218ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88f6ff5e62731ae2b47623b51c1fc2a5e259cd5f28a54465e98ef240aa1218ec
SHA3-384 hash: 115ef5068482fa2bb988a99f7d5f81cdcaf4a43bcaa6d919d9e248287e94c900001338defa140bbe58b56150ca48e706
SHA1 hash: 17a922bc273b3dbd277b0513435feb8e60825eae
MD5 hash: b3700892ae6655b5de4e7f19a32e28ef
humanhash: early-december-maryland-network
File name:88f6ff5e62731ae2b47623b51c1fc2a5e259cd5f28a54465e98ef240aa1218ec.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'560 bytes
First seen:2020-04-09 07:49:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0835f48e637176084abc6ab839a429ce (1 x AgentTesla)
ssdeep 6144:KwAbMS50jqga2nMCVJh0dYCSORKDsPSMn+vkS6z+YoI813AqK0f2y:K/MS50mgacMi0dYCDC8SM+vE+gSAqj+
Threatray 10'957 similar samples on MalwareBazaar
TLSH F3841242BE04A819C9D529B16527BCEA13947D53FF882B3349C9FD1F7831AE65B06BC0
Reporter JoulK
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-08 07:32:14 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rd3p6xtcomnofndweo2ryh6cuxrfttk7fcsuizpjr3zebkqsddwa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
2240c11ab9505ff6c17ea4b7d03ccb3b072e19d94357ead07116ba108c9d900d
AgentTesla
3d90a7ed860b61af979db3c2e1ffc57615ee7a1f8e1386123d38a86c00a1572a
AgentTesla
428d4131025b3380f27194c9962cd333f871564d8cd0f46cfe1988154f487c7c
AgentTesla
5c2be89f4ae2a9cb4f80b264b98026986b76c1f971a5ee7bfe138fcfdb196430
AgentTesla
765d4e32e33979b9ee122877162ddb3741a2cc7df514b96b637e28651399be70
AgentTesla
836fecdac95ba8327cf6e573e45c5f21096099e7f751ac7c6705ee8f43b2c94f
AgentTesla
948a9a4b496fc673f982932704127dff693ecc406254af11d1e9029f2b85553d
AgentTesla
b00945cd0c4c0ec8a60178147f75757ceeb27574d8edad11f435ed7105a92e33
AgentTesla
c3d8a2df50dffafea2a385695cb95e534bbb16c3ccb22675d8f1cc40dd4b4bba
AgentTesla
c506e03e2ef24d1a95ff314bb7f9470e87cc27281570cf606d2a408097e82757
AgentTesla
+ 10'947 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments