MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b2ec3cbaca68c03cabfbd50b7b94908971b26a52e5eacd80d499844944929c1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 6
| SHA256 hash: | b2ec3cbaca68c03cabfbd50b7b94908971b26a52e5eacd80d499844944929c1b |
|---|---|
| SHA3-384 hash: | b2c578558f44c0d9ed5c878375f69f783a95eb38ff4b47208367f629f4d036f45c22e359cfe4d21d377a69cbbfbce701 |
| SHA1 hash: | dd5784bc67cda7a91e2c75e9554c726af13cc523 |
| MD5 hash: | 9e142259a1b2273af64b44085e03a58c |
| humanhash: | massachusetts-leopard-river-speaker |
| File name: | Sample Order.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 859'648 bytes |
| First seen: | 2020-11-18 12:18:08 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5113dec31b8616dbad783836e7188783 (11 x AgentTesla, 2 x HawkEye, 2 x Loki) |
| ssdeep | 12288:Nl1aMljBMKnw6WJoGPb5FUoRAVyImHlawaZWDLzpj2DNN:tJCKxWfPNFwyIUlawKWDdiNN |
| Threatray | 2'814 similar samples on MalwareBazaar |
| TLSH | 80057C22BEE15C33C0E356388CCB5E789D2EB9D1292769972BE85D4CDF39281381D197 |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing unidentified malware:HELO: server3407.uncscloud.com
Sending IP: 51.91.75.135
From: Amanda Chen <info@fasttrans.org>
Subject: RFQ: Sample Order
Attachment: Sample Order.gz (contains "Sample Order.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Unauthorized injection to a recently created process
Using the Windows Management Instrumentation requests
Result
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
Contains functionality to detect sleep reduction / modifications
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2020-11-18 10:26:35 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
agenttesla
Similar samples:
+ 2'804 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Unpacked files
SH256 hash:
b2ec3cbaca68c03cabfbd50b7b94908971b26a52e5eacd80d499844944929c1b
MD5 hash:
9e142259a1b2273af64b44085e03a58c
SHA1 hash:
dd5784bc67cda7a91e2c75e9554c726af13cc523
SH256 hash:
411fe156c01f6a7713245dbbf9d2ba6e40bd1c4155fd9116f064cd97e065713d
MD5 hash:
7afca6842f110e07f3c6476615e4fd5e
SHA1 hash:
09b46edfbc280ce65e05f46507dd6e245a9b4424
SH256 hash:
70092ac10c4eb9346d37c043150976587391f75decf32164faa38ef1b36eab5d
MD5 hash:
016673c424ca8e8d8e9238ff73ecabe6
SHA1 hash:
811ccae121a123d821b02b1e3e4ac1d235484483
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.