MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2227af7988365bb51274e69f54152d4ccea7bc1f3346718e8c88dfff02bd230. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2227af7988365bb51274e69f54152d4ccea7bc1f3346718e8c88dfff02bd230
SHA3-384 hash: 016451e67ef61b8df264e0b4f94f385a3a6f0efa73f9e110149db43098b91e016ff67b60b0ae4fe249524e759d9c5b6b
SHA1 hash: b4ba58a2ace57285cd2ab14fc473c7f50ea41604
MD5 hash: 466a20d31f3c96fb12c0906a799e6acf
humanhash: six-india-ceiling-johnny
File name:SecuriteInfo.com.BehavesLike.Win32.Generic.cc.9919
Download: download sample
Signature AgentTesla
Create hunting rule
File size:850'432 bytes
First seen:2020-04-20 21:00:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:zjpRpqQnLZHi/+TCpjdgZtk7cFrJHNMLojgqjYhN1H4iEAEgDIr1uNtYTyRHZpPu:zjpaYL1U+GrgTKy1ra
Threatray 10'895 similar samples on MalwareBazaar
TLSH BA053AAC36A0719ED473DE768AE82C64EA257577A71BC20B501302DD8E0DB87DF106B7
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.cc.9919.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-20 20:47:11 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uirhv54yqns3wujhjzu7kqks2tgou66b6m2goghizcg774bl2iya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
07bc470464ce00995e600db9eb95648c63e0bf5f086e358b15616a5aa8c816b3
AgentTesla
35ead1509ef16cc4518f6344a09ac4a93881ba8380a57a9f75a1c0beca41c9d6
AgentTesla
48963ff3aac457211892a3a460fadce81da3a5398a49aeacecfa4b5eac934154
AgentTesla
5eebc0f8cb488199691e69c343dacd24f57f873c05ba6ec25efbdffeaaba17ff
AgentTesla
6af32b6b849f1186317e65f84c1d59cc03ce878ca8e3706c5d7afae2389b3c64
AgentTesla
8e6f297527e6eb70b658b01c08cf16d6e88a1d5716eaf2f3162ab5b972112ba9
AgentTesla
cb1927e26dcf4dc646884e37de470cf002be82095aa7b6d1d4230f78c34b26ca
AgentTesla
df7c4243f9b8c7087628a1d52e81341e588e58695dfea9c02202266537e10540
AgentTesla
ff0dfc8a3f301d01a87dd618a831e5ec8409d7b1ef22fcc0ae595a7775ca7059
AgentTesla
ffaecfe0e94157f82c2c6b162c2e97c081d2d6c7d64bab85cea7ec9684dde8c5
AgentTesla
+ 10'885 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe a2227af7988365bb51274e69f54152d4ccea7bc1f3346718e8c88dfff02bd230

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/346944/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments