MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4c70297087ab9d2ba1dfa7452273fdf66295bf4ab7fa001e04841a9dd8c02ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: a4c70297087ab9d2ba1dfa7452273fdf66295bf4ab7fa001e04841a9dd8c02ef
SHA3-384 hash: acc2dbbc1c12432459d53993cb7a06dd40f4a1364909e2251a9c71b710921390275c8ed5ffc96c8b0f9937da7d3d1878
SHA1 hash: 91f2f90bf2d0d32172b207d32bc36b08ca0a44be
MD5 hash: a44c19ade0a232bea5617b7d512217fa
humanhash: violet-romeo-muppet-yankee
File name:a44c19ade0a232bea5617b7d512217fa.exe
Download: download sample
Signature AgentTesla
File size:704'512 bytes
First seen:2020-06-30 13:34:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 24f26e153c9b6068c0a4770547eb6d9e
ssdeep 12288:7CbpcLhilrm7G8oclWEAroCo3DQmTrSMkpFir+ZM2kabyvLe4n:suLhi80Jro7Y0r+Znbie4n
TLSH B7E4AE22E7A0443FF07E363D9D6B56BC982ABE51392C59462BE4DC4C6F393413936287
Reporter @abuse_ch
Tags:AgentTesla exe

Intelligence


Mail intelligence No data
# of uploads 1
# of downloads 35
Origin country US US
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/17233/
ClamAV SecuriteInfo.com.Win32.Herz.B.23927.UNOFFICIAL
PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
SecuriteInfo.com.Variant.Zusy.307895.13627.19246.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/a4c70297087ab9d2ba1dfa7452273fdf66295bf4ab7fa001e04841a9dd8c02ef/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Injector
First seen:2020-06-30 13:36:05 UTC
AV detection:23 of 31 (74.19%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-9cm983agp6/
Tags:spyware keylogger trojan stealer family:agenttesla persistence
VirusTotal:Virustotal results 49.32%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe a4c70297087ab9d2ba1dfa7452273fdf66295bf4ab7fa001e04841a9dd8c02ef

(this sample)

  
Delivery method
Distributed via web download

Comments