MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b50536b4f6f667c4f20a7b4cf9f5c2050392ef1eb2d3fa0607c16d96f4e5f221. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b50536b4f6f667c4f20a7b4cf9f5c2050392ef1eb2d3fa0607c16d96f4e5f221
SHA3-384 hash: d5cf308d584f5a12283dfaf63494f9bf18d071b2470cf10916214d471664697836dba764b029fada10b886f068201212
SHA1 hash: 458efaddc9e75f4f3adcb4cab34d66fcfeb089a8
MD5 hash: a48fa89dbeff7469469fb52e97b094b3
humanhash: monkey-alpha-yellow-zulu
File name:P O.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'336 bytes
First seen:2020-06-19 04:38:03 UTC
Last seen:2020-06-22 07:22:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:gXGJCUn9caMTlQJAFwUrPvYLp+y8ATtWjd:gWAUn94Qmw2nYLpBIjd
Threatray 1'518 similar samples on MalwareBazaar
TLSH 92A47D7FE686655FE2956C3B89823FE2231038422C1BD3907849BE775C951CDCA52ECB
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
4
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/19863/
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.3381.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 22:02:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wuctnnhw6zt4j4qkpngpt5ocaubzf3y6wlj7ubqhyfwzn5hf6iqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
147e0bd6d82f2f3d9b402dec62020c117350407cf2871dd73a14a137ae647fd5
AgentTesla
2ba2967a4d170914094d511861a98d9be4f39aa45f5bed35e7d04013508f19fe
AgentTesla
2fa1eb179872a0c83b944f67d300e1ee6afbe4c31afa3eb687eafaa1e8571e71
AgentTesla
7cbad73d42c4241072e2163720a87762f258cbeca1584839d7ed7ee1148559e1
AgentTesla
9330ee2921887af4f02427f37ea2a7d0a296e2f82fe88c7001d73f74258ff92c
AgentTesla
977eb3104726250bc364dcb5732a75c743c502bd816aef9c813ba73cb1ce3cbd
AgentTesla
9ce61ae5037ceb9f8ce9dac6288d9125230dc58f58a4e1450e85081a8a620c15
AgentTesla
aa530c5bf4006eb53797d6617fce896f3ac536f35c596afcee611f9b8649f4a9
AgentTesla
c58f0824b5c50b5988d4aa44635c1027209920bd8ab9baa6be6bd75997fc86bd
AgentTesla
dc61af34a94463996df082d9588b579b22f4b7bf6a63299d82cc51593b590352
AgentTesla
+ 1'508 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200624-6cetvvlhtj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5c99ad499e20ba54c1aee8fef51c279081c3d3b0cfc434505b623a3e8046f544

AgentTesla

Executable exe b50536b4f6f667c4f20a7b4cf9f5c2050392ef1eb2d3fa0607c16d96f4e5f221

(this sample)

  
Dropped by
MD5 897a1b9ec5f2ae7dc500118e2520b201
  
Dropped by
SHA256 5c99ad499e20ba54c1aee8fef51c279081c3d3b0cfc434505b623a3e8046f544
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/19863/

Comments