MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b1a2b363a87d3f8bc4f184fe929f6025acf4da4d0379d595ea006e884a12179d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | b1a2b363a87d3f8bc4f184fe929f6025acf4da4d0379d595ea006e884a12179d |
|---|---|
| SHA3-384 hash: | 4e2a8dd8556f75ca1963c103a7aabad2fc46c9119b2468b99dbd36e11e86a4e40764fcb2f66b872f756aacd775124e51 |
| SHA1 hash: | 79dc083ee22f5375068835776cbf79d8ad60fef0 |
| MD5 hash: | 723b81b1678222ffd6b6262ea5eba4b5 |
| humanhash: | ohio-april-william-thirteen |
| File name: | COMPANY SAMPLES FOR OUR ORDER.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 798'720 bytes |
| First seen: | 2020-10-12 14:56:47 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 24576:glr2TgdK1V8K191cIxybXZXZgP9wHPIHTqS:gl/dK/8K191cIx4Jq9AAzq |
| Threatray | 494 similar samples on MalwareBazaar |
| TLSH | DA05F02127A59F86E17E9BF50264215003F53A2B396FF21D2DC629EF6AB5F418600F73 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing unidentified malware:HELO: hydrometik.co.in
Sending IP: 193.142.58.25
From: Rupesh. Patil<purchase@hydrometik.co.in>
Subject: COMPANY ATTECHED IMAGE AND SAMPLES FOR OUR ORDER
Attachment: COMPANY SAMPLES FOR OUR ORDER.rar (contains "COMPANY SAMPLES FOR OUR ORDER.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Status:
Malicious
First seen:
2020-10-12 10:13:23 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 484 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
evasion
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
b1a2b363a87d3f8bc4f184fe929f6025acf4da4d0379d595ea006e884a12179d
MD5 hash:
723b81b1678222ffd6b6262ea5eba4b5
SHA1 hash:
79dc083ee22f5375068835776cbf79d8ad60fef0
SH256 hash:
0493e6a05b9f98cc6ab5de172d76b43763ea3d6b0f6ba3a4cd6f7d999b6e7697
MD5 hash:
67f4fa6590b997532032614f60afd181
SHA1 hash:
2ed01f7d0570b51c26bdf8bc8dcffd13f8e20038
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
SH256 hash:
20f6b5e8b0f697eec9c2a4d14ac355fb0a1e94095f8631482b39b16a9ed312bf
MD5 hash:
de6872cf0e81a9e4955fa8492a626a97
SHA1 hash:
f96e5f5f4e04775ba4460cd8e46cb51622da5144
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.