MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dac5d9196faedeb85b45146e13678ef1d0e0e2ca452d0ad877eb3e735648f614. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dac5d9196faedeb85b45146e13678ef1d0e0e2ca452d0ad877eb3e735648f614
SHA3-384 hash: cbe3f6955a09c7b783473f22df28c79bf45fd8a0200f444d0e2890d93008a69dd9be788f6561b0cfe33fd61bc688083b
SHA1 hash: 7183cabf59542053adc377834be19a0ff2fd1e0d
MD5 hash: 8b49f1bc733e6c51f9e95dcd5a38b89a
humanhash: leopard-kansas-ohio-crazy
File name:Purchase Order_pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:442'880 bytes
First seen:2020-04-09 13:24:27 UTC
Last seen:2020-04-09 13:35:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:fy4P+MSs5+07RAR0BMx9lOkdc45H/TxPX+zGmAjemZictjNKrOSElcVQKhSK0CLP:fPPt8gCR0BMxHbdc45H/TxPX+zGmAjeb
Threatray 725 similar samples on MalwareBazaar
TLSH 1B94D086165F86A1F4BDD97F9E07301E87BB77472D23274B072818E07A875C704E2AAD
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.13.7660.3059.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-09 10:19:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lc5sglpv3plqw2fcrxbgz4o6hiobywkiuwqvwdx5m7hgvsi6yka._file
Verdict:
unknown
Similar samples:
04c5015ffe8fbe6af40504bf9facf11b5c48bc98f9ec8fb0220c1849ae0772a8
AgentTesla
0964a12c3747d2996ee28bfa5f158acfe663131b9678260b00e24a9f8c39429a
AgentTesla
33f3c581f4bc6cb4c7e6b63a6857220ab404020f188650f11bf0ec55e96877a4
AgentTesla
5762e429d25efdcb7a5536adc7f5834c34e133b4b01667c2d0498cfbfba31797
AgentTesla
59aaaca777876da03ce73437def6b4be378bd680e7eecbfd60f70fe058fb5f1b
AgentTesla
799e7b4209f8eaba177033adfeede982f04fc78671aa15d64e57d82b9040a92b
AgentTesla
8b334c052aa35c751a90affd750f2f0522fe23c68ae332cce60d4c1337a61261
AgentTesla
a2dae501094b43257d7ea19fbf30264ff733a52d940f1a6ddd96f2492e35a77b
AgentTesla
adb110bdb4307860ea333e9a4d78bd39a85789eb3023b254bc79c1eb8b8b1f95
AgentTesla
ccf82f0f1e542d73385df3b68f7e9fdcae3d9e2a091ea879602ba287b0199203
AgentTesla
+ 715 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments