MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcaf5698e3d5291c284e0ea40deec27e69c4942049f1c90a4e334e066485dfa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	bcaf5698e3d5291c284e0ea40deec27e69c4942049f1c90a4e334e066485dfa9
SHA3-384 hash:	58cb8557dc7293e4d8878fde17b35d721cbbeded5db836d3298ff51c6483379b31e299d34cc9ed47d22a6f31586281e1
SHA1 hash:	337b8837f71dd5cadf791ebf05e46e0918b488af
MD5 hash:	a703eddc151334c7cb9d76411e7867f8
humanhash:	thirteen-moon-illinois-ohio
File name:	Mormetal MayJune order.exe
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	512'512 bytes
First seen:	2020-05-03 08:04:37 UTC
Last seen:	2020-05-03 08:49:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	6144:rSNuRdeLs+7+lu8hALCDhoisxpRAo/2mJxbxBphsp/GCJ93DenRNtjxh0hzT/7HJ:rMuvegNlnCEsx3/pAjP3GlSHumWGQ
Threatray	10'530 similar samples on MalwareBazaar
TLSH	CEB4D1683AEE562FE2BE5E74B9C47062A779F2B33203F31B549103464D23B529F8511B
Reporter	abuse_ch
Tags:	AgentTesla exe

abuse_ch

Malspam distributing AgentTesla:

HELO: mail.euromaster.es
Sending IP: 82.223.70.126
From: Meliha Surme <export@mormetal.com.tr>
Subject: Fw: new Order
Attachment: Mormetal MayJune order.zip (contains "Mormetal MayJune order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Fonctuzim.1.12967.5607.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-03 08:08:40 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xsxvnghd2uurykcob2sa33wcpzu4jfbajhy4scsognhamzef36uq._file

Verdict:

malicious

Label(s):

agenttesla

AgentTesla

2c6aa8d5fd233661b6d8c0130af1a0c63539aae4c05fb03d74859ebeec3b7cc6

AgentTesla

4c886afcf091e440b12ade502e4b8dcd2e9995cb2c10d7c0f8fd16e736d6fca6

AgentTesla

5a580662c9234f0bd298d4a5b9152f42f047c7be63f9b570614c0118f8b6afc4

AgentTesla

5adb192079fbc16f4631d3e5c894d9bec1ed384e7be85742c4f076760eb64a0f

AgentTesla

b26960e8083466e40ebbfcc6dfe93c4080a516d6260e1a2900ce7649fc44442e

AgentTesla

b5633218ddae3b49aec89824e1032e4826fb8504d39b64b3dbe1b2ff59d38f56

AgentTesla

c315112980543e9046f7b3167586d3a5ba25734aac85679542adaca7867f3ef7

AgentTesla

dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f

AgentTesla

e738d23963c1001eb3cc3287fd96bacb4a4f073c665c866bc3cadf39d71350e8

AgentTesla

+ 10'520 additional samples on MalwareBazaar

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar