MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94538948c885f55d6120782322773ad9a34d7c9c318938c850ac6d55bdd3ad52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94538948c885f55d6120782322773ad9a34d7c9c318938c850ac6d55bdd3ad52
SHA3-384 hash: db1c4e3eb79c7b62e7fd7f6dd6c76924bc5de3bb9ca4e72a165cec7de2b23bdf09d52cae0cf953ffb0b4bab523fc7f50
SHA1 hash: e4acf88e66d758a2d1af678f56a1f4845acc2dbc
MD5 hash: 914e8a972323d13655a858dbeef68ecb
humanhash: twenty-paris-fish-golf
File name:914e8a972323d13655a858dbeef68ecb.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'064 bytes
First seen:2020-06-03 07:57:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:nHYRurAiBVTQBDuNa5gH9YemlsDpsOBYS8u2Z0N2wc:n4RurAiBVMBDL5AnD+AH8pZ2c
Threatray 1'452 similar samples on MalwareBazaar
TLSH 6494120E33BC5A1FE26D4DF9B056208587F482732859E3684F512CF945FB3D22982E9B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 18:29:59 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=srjyssgiqx2v2yjaparse5z23gru27e4ggetrscqvrwvlpotvvja._file
Verdict:
unknown
Similar samples:
0889ef2c911176a675f2223f16ffa240d096583baca907efa7c0da5ea31a8608
AgentTesla
0f3fe234c700b316a460c05098c843efbb0965b672d0e7a6f58028669c37ccb9
AgentTesla
22525129004fbb8dbbc180fd0898cc33801cc75a9d6fc1072020ae12b4c2de88
AgentTesla
26c5098fbb4be4871383a901013288d16a6a2aad7d0952c28fd888e080aea394
AgentTesla
271d081750e61123ceda8a898533f5b636254030a65f14a71ecae2b8ea649443
AgentTesla
2f6a6d53e0ea3b6314279e5990a77c0acd90791f677086bf0a1b40fa48917222
AgentTesla
9caf8ad45b0899bf225ca383b93a18cafa6d7c666b9aab9eaa88ce0075daa63e
AgentTesla
a3f8c63b9925504706f889dc1bc944a5485144007b80b042cf53accda4f650c1
AgentTesla
ee02d4480e7e74c5015af1c4617271afb1ea208b0992050726ae3bf44e268cec
AgentTesla
f0006754d451556014c91039915ea9505f348f80538e536d30b75c5ef252d73d
AgentTesla
+ 1'442 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla coreentity keylogger persistence rezer0 spyware stealer trojan
Link:
https://tria.ge/reports/201109-723hdtqc66/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies service
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla Payload
rezer0
AgentTesla
CoreEntity .NET Packer
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe 94538948c885f55d6120782322773ad9a34d7c9c318938c850ac6d55bdd3ad52

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments