MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7b61308aa3ad9f3ac1d3da335b4dbda67bc4878d25162c222e631b18ffe5f7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: c7b61308aa3ad9f3ac1d3da335b4dbda67bc4878d25162c222e631b18ffe5f7a
SHA3-384 hash: 577de2a650b6b43c33fb9767773d4e1a9293682bab6a898b75e87ac877a9115ed1e1666ede3189733175b6a28611be2d
SHA1 hash: 433c19c056b5620baa3b031b183aa08d91017ebf
MD5 hash: f866deba3b9e2c4a0edacc515492f84b
humanhash: spaghetti-pip-six-bacon
File name:f866deba3b9e2c4a0edacc515492f84b.exe
Download: download sample
Signature AgentTesla
File size:407'552 bytes
First seen:2020-06-30 13:09:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:VcPSidEu7ykFK+q9ZeJ1DDlH4zqrhleIkFoD:VcPSidEu7ykFHqzWNlYq9leIkFQ
TLSH 4184123573B99B29DABCA3F416B108110FF2BD0B2991E35E5D94E0CA0DB7B008965F63
Reporter @abuse_ch
Tags:AgentTesla exe

AgentTesla SMTP exfil server:


Mail intelligence No data
# of uploads 1
# of downloads 27
Origin country FR FR
CAPE Sandbox Detection:AgentTeslaV2
CERT.PL MWDB Detection:agenttesla
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 08:15:18 UTC
AV detection:16 of 31 (51.61%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Tags:spyware keylogger trojan stealer family:agenttesla persistence
VirusTotal:Virustotal results 8.33%

Yara Signatures

Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Rule name:win_agent_tesla_w1
Description:Detect Agent Tesla based on common .NET code sequences

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe c7b61308aa3ad9f3ac1d3da335b4dbda67bc4878d25162c222e631b18ffe5f7a

(this sample)

Delivery method
Distributed via web download