MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b79575224117cddb4e62b8aad2f2b508ec66ba70b2f86f1d52bdfb7003564fcd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 7
| SHA256 hash: | b79575224117cddb4e62b8aad2f2b508ec66ba70b2f86f1d52bdfb7003564fcd |
|---|---|
| SHA3-384 hash: | 388ce4c0f93bc6d48d15f2dbcc22bb39fb24d63f47df2058efa271a7faae9c911894691ceaee90bed2663c1f962beb00 |
| SHA1 hash: | dbcf720c362365eee847fd7a7adc6d3be37c839e |
| MD5 hash: | 5691400fffafbeec84835261a33fa973 |
| humanhash: | double-oklahoma-leopard-princess |
| File name: | DHL RECEIPT.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 692'736 bytes |
| First seen: | 2021-05-05 18:21:14 UTC |
| Last seen: | 2021-05-05 19:03:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:hjooLLoS60/K7yh0LACFow2rYvCO1WSpDaR3ViM1ujBumqLGs+E:JooLANaOASkt8jjCL |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | A0E45BAC751869F1E35B5E2263CF0C0643651174A93BEA0E8F6013FA4A57F173E3998E |
| Reporter |  abuse_ch |
| Tags: | AgentTesla DHL exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2021-05-05 18:22:11 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla keylogger persistence spyware stealer trojan
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
74b2935b9dfe4ba397fd0507ae3c36abb77193041f2e7c43c55dc4e7b33de61c
MD5 hash:
b5c218f30fecc9cb8513ff6a46737b01
SHA1 hash:
f0416867c2b114789620b318051f1fa390b07eae
SH256 hash:
f2764c8c88fa89a3c4acf4d3bd60b8bf912abb36735804057cd4f9ccef1a4d3e
MD5 hash:
09ad87e9b7763dccf59e3d44699280ee
SHA1 hash:
da7c3bd1a93d5e7052777b9219e79a0cebb725ab
SH256 hash:
88acd800ab42281eacc19cfdc07864529a67f5d07377c76a7572bccea1229071
MD5 hash:
b61bdf9710f110e9db9feb8374bd8f82
SHA1 hash:
d88f1cdb2f143b7b3fb8e8576bb3e80863c1dc2b
SH256 hash:
b79575224117cddb4e62b8aad2f2b508ec66ba70b2f86f1d52bdfb7003564fcd
MD5 hash:
5691400fffafbeec84835261a33fa973
SHA1 hash:
dbcf720c362365eee847fd7a7adc6d3be37c839e
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu |
|---|---|
| Author: | ditekSHen |
| Description: | Detect executables with stomped PE compilation timestamp that is greater than local current time |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.