MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1df81fb527676386e4da96764d98715e9726891ee5097e765c1e6f467347ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1df81fb527676386e4da96764d98715e9726891ee5097e765c1e6f467347ab2
SHA3-384 hash: d7840a0c9cc074de8ad25af887e2b31167dc202841f914de4ceddf17b01af0c57e6b214da0456134764c7bacc81f6129
SHA1 hash: 2e3dfac4ceb24c89329711f4d7e3f61c5f609696
MD5 hash: 4a48e52df4596a24316a89ec75e5146c
humanhash: autumn-seven-paris-crazy
File name:358a07c8af27d4ffd8f043c4a5fa5532
Download: download sample
Signature AgentTesla
Create hunting rule
File size:754'176 bytes
First seen:2020-11-17 12:03:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3e0c51f5711a5619dc8763ea2a3be01d (10 x AgentTesla, 2 x AveMariaRAT)
ssdeep 12288:8Acw5oE/xl3BnNouoVkXBZxV1wuNA1SgHey3DhEMwL9bpypiRQ:8Cooxl3BNou8uW1Smv1EdL9zG
Threatray 1'322 similar samples on MalwareBazaar
TLSH D4F4480096F5E7A6D432D4F04F04B53986D99C34E62F7C6AEB8D3E6A553ADC8A21F301
Reporter seifreed
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% subdirectories
Creating a file
Running batch commands
Launching a process
Modifying an executable file
Unauthorized injection to a recently created process
Creating a window
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1df81fb527676386e4da96764d98715e9726891ee5097e765c1e6f467347ab2/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:06:34 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yhpyd62soz3dq3snvftwjwmhcxuxe2er5zijpz3fyhtpizzupkza._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
13207816457e33a0430e6da6d1ab86d9797f9c2895a7491c142b5b8bfee3bb0d
AgentTesla
14fbd7283be9da4d0fe9736a3a86b1b779b4c4abdb077f0647625fd5ad8068ec
AgentTesla
1e3772fb826af045d4d6aa5943be1c66bfca44858adaee941606ebce680373d1
AgentTesla
31705dc52cd25b1a406341a071401d39833225a184c0918214edf72cd3a77a57
AgentTesla
639aa73ed2700349b87c9a12879447b219dfd137f60f50611588e9ced7726392
AgentTesla
acef7155f56a1434770c602a92ebf4945474ad85e9382df19ff5d3ffee461423
AgentTesla
c2c8dd06ab505a3989373e72a3f565054a63716424f559592859024d2bade1d7
AgentTesla
c7c371104c985df2506b6f9b0e4133e61c96e45d9f96a9961369d52e9f9f972b
AgentTesla
d5e67d8afe482552613fba4bb051266e15a3f0325956154014047ea92ff7e77f
AgentTesla
e788686b2a0e0efbf94e3f33a47e63494ca216e965191d82cd2922b8af6fe037
AgentTesla
+ 1'312 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201117-sy4zl74cps/
Unpacked files
SH256 hash:
c1df81fb527676386e4da96764d98715e9726891ee5097e765c1e6f467347ab2
MD5 hash:
4a48e52df4596a24316a89ec75e5146c
SHA1 hash:
2e3dfac4ceb24c89329711f4d7e3f61c5f609696
Link:
https://www.unpac.me/results/21ca1b6e-e31b-42b7-9cd4-fa2cfee562a4/
SH256 hash:
6f7759688157fb1d8b794098e962d650c46c6adbea85938bf6723d145d285f7f
MD5 hash:
f89a14aaa4d23c900eab55f4a7769024
SHA1 hash:
0c0a6d063b183bacd3f8dcf5165eb148cdd6d6e8
Link:
https://www.unpac.me/results/21ca1b6e-e31b-42b7-9cd4-fa2cfee562a4/
SH256 hash:
5f203ad92f3841f8e0749c202d7a16478274989f6f53c18775c15f40e4e23331
MD5 hash:
46752c1d2ec8eeac7b2f7dd0ffa52209
SHA1 hash:
ba78895d407c29276f1011eb1499feceb50c4f42
Link:
https://www.unpac.me/results/21ca1b6e-e31b-42b7-9cd4-fa2cfee562a4/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_AgentTesla_20200929
Create hunting rule
Author:abuse.ch
Description:Detects AgentTesla PE
Rule name:win_agent_tesla_v1
Create hunting rule
Author:Johannes Bader @viql
Description:detects Agent Tesla

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments