MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c31b26ce66fcdc549c84e8621fa82d2865714af5b1a3cb3b6fbd55cc2f998ed0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c31b26ce66fcdc549c84e8621fa82d2865714af5b1a3cb3b6fbd55cc2f998ed0
SHA3-384 hash: d65a3c20687fb8229bf6346b998541d209e5c817f6416e0ed3539be66e2be177d9d1085e80e8c4ebad6b5b47fdebc5d2
SHA1 hash: 8a0a6ddfb2b1de8b06c723610824f726aba84104
MD5 hash: 357ae968ff824c3baa1bf98e80ff4614
humanhash: carpet-cardinal-floor-oklahoma
File name:PO_12553_from_Vision_Imaging_Supplies_Inc._19784_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:514'560 bytes
First seen:2021-05-20 13:18:38 UTC
Last seen:2021-05-20 14:05:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'654 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:fFMSKz+gOHgyTNTe19sripsE4gSsg4DQetfQAM2+:9yz+gOZebsripngf4DQ+fQAS
Threatray 5'133 similar samples on MalwareBazaar
TLSH E5B412222B286764F53EEB7C9814E42407F16D09E312F72E9FD8919905D1FC782F6B62
Reporter GovCERT_CH
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/159642/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.747-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c31b26ce66fcdc549c84e8621fa82d2865714af5b1a3cb3b6fbd55cc2f998ed0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-20 13:19:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymnsnttg7tofjhee5brb7kbnfbsxcsxvwgr4wo3pxvk4yl4zr3ia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0063947555fada876477c4e186d19517a3894d56153477590b0d6367ec80fe2d
AgentTesla
418b8285d8a2e7129052ca76c5f30243713e543ee94b603cc71858566d15e50b
AgentTesla
59bb93fc55b4001194975c7afc12c336454301b2bae77b6087456211a3c5989d
AgentTesla
5b2c9f25ec69fc887f9d68e2bf16a2451d814c28336eaec4e52d976723e068c5
AgentTesla
8c35dc71998561bad15183fe5ce76463fb2651692f72e92cc2d065f69f47b5cd
AgentTesla
9921c6e293b224a6e9934694f7b16af2656ff0de0dcbec9c0e10a37601bf0296
AgentTesla
9b21045796c15c4348f79483c825882c491de047a0ca577e0eb6ba770c60e9f6
AgentTesla
bf4a95df4ed9665758637f1f29705fd954aaf5a4b9e4e5d89025ddb6f8331904
AgentTesla
c05e310c646407fa733712a98c822a5416ca1124322429d8d2a90966e909a6b5
AgentTesla
db302733f7d15057ff2d61f51bd5c12c95d0afa31c001897fca1c9025f735167
AgentTesla
+ 5'123 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210520-nh3rmk9yn2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c31b26ce66fcdc549c84e8621fa82d2865714af5b1a3cb3b6fbd55cc2f998ed0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

Executable exe c31b26ce66fcdc549c84e8621fa82d2865714af5b1a3cb3b6fbd55cc2f998ed0

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/159642/

Comments