MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2
SHA3-384 hash: 4e15a9cb9b83a7094e9002fdfb9842a19200a070e54a3d1292fbd7e06dca9761a39cd01f80f2320faf23262a291aeeb7
SHA1 hash: 9b3768e6676984c90a0ad251a588e6b0ecfca365
MD5 hash: cbc2d2fda4346646489382819fb07d61
humanhash: pizza-cat-artist-social
File name:92c492_8f22087a2c0740eba07c3aea05e107e7.ps1
Download: download sample
Signature AgentTesla
Create hunting rule
File size:778'222 bytes
First seen:2021-10-18 10:35:02 UTC
Last seen:2021-10-18 10:35:17 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 1536:H0DwVcA18t9LMTdDBaUv280jUSDrBlmpVs7ab/vD2uBgubpvG+K3LTbPdTfnX4mB:E
Threatray 11'948 similar samples on MalwareBazaar
TLSH T1E2F4D0B6038047AAE3C90BD0411AA10F15F2E5167564259DEFB36EEFBC2ADD35878273
Reporter pr0xylife
Tags:AgentTesla ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PowerShell.Packed.54.1198.22492.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
50%
Link:
https://www.filescan.io/uploads/616d4ddedb358dd15ebf1b76/reports/f36c6171-5aad-406e-8872-6f8601b51ab6/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2/
Threat name:
Script-PowerShell.Trojan.PShellInj
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 10:36:06 UTC
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09b7bf15736eeb15efdae06322e1aa1e8f960d3264aa380ab0ba05a348aadca6
AgentTesla
31201f4e6369ec56c6c3e839131b6011c1c76dc7665d33705361091de32e29a2
AgentTesla
4fcca1bce2dd80a24a9def40ab28cc5197e8dd477c2ef77c4d47a19b73fa8bf1
AgentTesla
5b8e5eaab8f48bd7ac92bf7437383abc5182ec3667443de0aee1f5d2b8711750
AgentTesla
8079c489c34ad2b7412bd0fcaf69d31639827d60f35d7f8c0df6c58b293e91d1
AgentTesla
869147dc42f117713c1b9070d615deda8ff7d7baf8c5baea4ccee3c21829fa96
AgentTesla
8a70f4ed3411dcc105db26e7482b984c2acf72fbea2d87f348d29434361f6161
AgentTesla
d01b3522dd2a17cd248709a670e7da25be8ab17565848e76b1087d1d1e11fe33
AgentTesla
efe702eff8b1684d9a92b1a5f24e1f375033dd124e588ee30cc778adc16d76f1
AgentTesla
fb4beef772683d5977d8c5a3c65365efbcddc966795944f52d9f7f54e9b4ee7b
AgentTesla
+ 11'938 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Link:
https://tria.ge/reports/211018-mmn1esechl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops file in Drivers directory
AgentTesla Payload
AgentTesla
Malware Config
C2 Extraction:
http://103.125.190.248/j/p13n/mawa/b04042b22b2b6179257d.php
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d2606cc6318b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

PowerShell (PS) ps1 d2606cc6318b1e0c21de14cf79f8e06652e783e9239c84eec8bd2b0582ab6cd2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1695667/
  
Delivery method
Distributed via web download

Comments