MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f4bda20379f0175458a93982ba909bfad8bbbcfce5a4a7c8a0a32ca89f85a34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f4bda20379f0175458a93982ba909bfad8bbbcfce5a4a7c8a0a32ca89f85a34
SHA3-384 hash: a3728af7a02d6951148c4c3016fd45fc7ae4f1a8a6fa67c512acb8ae8b6e880798eb96d7f88790b93675e7a08a2d022a
SHA1 hash: be4c799c78eaff03ccb306030d86217914f7ba77
MD5 hash: 419452e6bd854968e25e4a820fcceb14
humanhash: west-virginia-virginia-island
File name:13eba5647b5fe6954a9796821d8240ec
Download: download sample
Signature AgentTesla
Create hunting rule
File size:626'186 bytes
First seen:2020-11-17 11:24:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2357bc7f54d6cfedfacd0c73986806fa (6 x AgentTesla, 2 x Formbook)
ssdeep 12288:4/Ovwk4trED8Fl9iLwCpBD291E7f0RSigkWlyVO7vg:4/OYkCa8gDtE1Wf0zWB7
Threatray 6 similar samples on MalwareBazaar
TLSH 94D4F1113788FEF2E802143642149A314C7A95B06E7F44D7FFC66E6EC528BC29279B5B
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f4bda20379f0175458a93982ba909bfad8bbbcfce5a4a7c8a0a32ca89f85a34/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:25:25 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5f5uibxt4axkrmksomcxkijx6wyxo6pzzneu7ekbizmvcpyli2a._file
Verdict:
unknown
Similar samples:
0b604e2f87afd12a073cba5691e606dfecc374e10d95b0078d722217ce300125
AgentTesla
344ae78ecc8cac02bb3dcd94c654b74543db829984f903f57dfab395639bfc72
AgentTesla
348acef68bed5a0d2f034135b22cedae642fe96251ab3d7ad150163403c3a145
AgentTesla
4b4ce2070aa958e7431643fc10c4b96ca8612747a2d5e0bf23ae31013ed71b59
AgentTesla
8de05d97b50a1b169bbe51c2d188c9fc1678e36d7d4bcfb269ba1536195d0a53
AgentTesla
c63da2dca25d6d1c17fcfd8041424f2232878b734072ab55f1c31a6fa083a9fa
AgentTesla
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-vmjdwadeaa/
Unpacked files
SH256 hash:
9f4bda20379f0175458a93982ba909bfad8bbbcfce5a4a7c8a0a32ca89f85a34
MD5 hash:
419452e6bd854968e25e4a820fcceb14
SHA1 hash:
be4c799c78eaff03ccb306030d86217914f7ba77
Link:
https://www.unpac.me/results/ecf6395d-0a73-463d-907b-7021cbbfbf81/
SH256 hash:
66606fc0ac7d5e7b58082c2f11dba9aa238bed2a33d6a859fa4569f5caf3b184
MD5 hash:
834d86abba62a558f4365c0b0a603891
SHA1 hash:
69c090d24046bd3c5b97ec09f0bbc5bcca7a71d6
Link:
https://www.unpac.me/results/ecf6395d-0a73-463d-907b-7021cbbfbf81/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekshen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments