MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
SHA3-384 hash: 46dafdcff440c96d5c3e951f5f362865b23c869c95d89a1f761573e90139a92d3b9c237a3f62ce2c561954c729e77a8c
SHA1 hash: 228e484ea5774087181d4e1ba8eceac7762bebfb
MD5 hash: f8c5fced0bff96f22a841442597daaaa
humanhash: seven-leopard-fish-tango
File name:b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
Download: download sample
Signature AgentTesla
Create hunting rule
File size:696'832 bytes
First seen:2020-11-12 13:59:42 UTC
Last seen:2024-07-24 20:37:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:ozPv7rgu4ionlzY1K+wT5W+imMPfuLrqMG2fTx4NoKg8643T:ozPv/gu4iolzYYlT5BxMPfu+CN4NoL8F
Threatray 1'147 similar samples on MalwareBazaar
TLSH 75E4E1AA2AD8C955D53D5378D02551F443B0FC02EA12EE0FE888BE7C79B37C1876E691
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:00:44 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwxlnutxgig7kyozxn32sxuxnrkspqluieus5r5vxl6eih7hi3ia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09ffd88cbd13cd8439d94e1b593d0d3d358dd5455d39f5b0c2a860095141a250
AgentTesla
1596485ee8331651ad1cf0e3b2bbff49bea4be5f8b1b051e6e520582b73b36f9
AgentTesla
37be898f8c2b0f9dfc4663070ae1ac1fd0f4edc08760d5c40fb18c7353f7f476
AgentTesla
3b274112221489ff1408360fbd3b4d691e5d0b10a28399fd2c4690336e6e9cdf
AgentTesla
40e302fcbc592e6f845df3a731f3204c3026ebc929d290f77477857a4dccb559
AgentTesla
6b3d1c1490d2245c68517ddbc6162dc80b9a63695095e43f51c2fef4df710d11
AgentTesla
aefa2f5a8448c792183fedf9d025becfb782102b749c0fe3be273975f2dc3b61
AgentTesla
cbc1b2bb407f02710060a11cdd74386337b92597af3d8de8c1d90c33672868ec
AgentTesla
d11ae1d5e09d63aa386479af620faf3b9053d12e6d3a8a1353aba274fef2153e
AgentTesla
e38e6ac839b8009c1c6d467ed4206f912c39a15af7a1fa7ba4a2a854e441fe50
AgentTesla
+ 1'137 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201112-ms98alwcgn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0
MD5 hash:
f8c5fced0bff96f22a841442597daaaa
SHA1 hash:
228e484ea5774087181d4e1ba8eceac7762bebfb
Link:
https://www.unpac.me/results/5d4b2c2e-b778-4c8e-a3e4-8ce7dbd76719/
SH256 hash:
bac5797bde4b2810766a40d95bcdb825ac5b395fcbadd139daa19a44a6cdc049
MD5 hash:
a92cc1f6e0a2742350dfda6726db14c0
SHA1 hash:
e5404e3ed46498deb8ad8966a774540c2b8e9c1e
Link:
https://www.unpac.me/results/5d4b2c2e-b778-4c8e-a3e4-8ce7dbd76719/
SH256 hash:
33e8149e22e56061482b52d7db723486acde52e1bedc2376c784d40f9fcbfef3
MD5 hash:
1cd895485fc1866c1bde566a636c1bfa
SHA1 hash:
fb527b3909ba021f134aac51f8c3a44282612369
Link:
https://www.unpac.me/results/5d4b2c2e-b778-4c8e-a3e4-8ce7dbd76719/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5aeb6d277320df561d9bb77a95e976c5527c17441292ec7b5bafc441fe746d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:MALWARE_Win_AgentTeslaV3
Create hunting rule
Author:ditekSHen
Description:AgentTeslaV3 infostealer payload
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments