MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b915d2e5f70b859d8c2eafc94bd593d3e53255444a5b4b651dfb9c2523d83d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b915d2e5f70b859d8c2eafc94bd593d3e53255444a5b4b651dfb9c2523d83d7
SHA3-384 hash: c12d92867985b202d9235fd8c68c02fa40a0293f38b5c714d74baaa49c8a87555894223952b00fbdf129d7d79b921c19
SHA1 hash: 01df9ce5d14d8efaf4a47582ebf47ad78d98eb65
MD5 hash: 608a9b31d0a355debe20e85581602a58
humanhash: quiet-failed-zulu-solar
File name:vSVBfSw.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:612'864 bytes
First seen:2020-04-14 05:43:46 UTC
Last seen:2020-04-14 06:47:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:r2kmA96vqrXHxwA2HtgP4QwaSCnRIzWQ40yF2SwLyI07izNoZXiA:akmgbpAtu4xaziO2zoONoZ
Threatray 569 similar samples on MalwareBazaar
TLSH 8FD4AF9277CD9F84F6E24A3E9D1DC0105A9CFD800A8EB36F39CDBA58B97175140A26DC
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/1956/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.47116.28875.18113.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-13 06:47:27 UTC
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=toiv2ls7oc4ftwgc5l6jjpkzhu7fgjkuiss3jnsr3644eur5qplq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
123765ca93c6c71f123934f0a1ea08487449d2bfab58f47f9c0a2d4cc645021b
AgentTesla
1cc84d3c06c9a283218310ac6d69e7161fd7605339b78035747c6f51021475ff
AgentTesla
2149d167c87cf15f48aa1852adcf96c9a62287a26496ff33892ecc67500d3be2
AgentTesla
55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f
AgentTesla
6ea011e6a1836355936582525e455b151057c89b7f1780ab52c6f5c4cb19ddad
AgentTesla
8247e9152d0b43ffa80b4c82843bb0903043841c8b9c855ff312461f6443faf4
AgentTesla
a14dc3eb54f3876b3a2bfc6e0aa105c832fc5424130c43248995cceda6790133
AgentTesla
c2c89da1518a4950cedec3129aa86fce21ccec502586e44a7f3b3757b44a1e1c
AgentTesla
c7ead8266de17cda17f2c1cf6b146c616a092f2a4d2e59cf80e2815976c5932d
AgentTesla
eed41a2c1215d2ca0ef2022172504a565b7a968e6263e173fceb6f1b1747d795
AgentTesla
+ 559 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/1956/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments