MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcd8e02505929d4ef4a4cf57338688a12d0f012a6f4258cbe1999386172add07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 3 Yara 3 Comments

SHA256 hash: dcd8e02505929d4ef4a4cf57338688a12d0f012a6f4258cbe1999386172add07
SHA3-384 hash: ea26841f5d0e314677085dd3a354da7149397850d821b88a5cb1fe8daeb82126cc29a2dc17cd058f8a1d55cdff146053
SHA1 hash: 5fea2ada1c7ae9ed64a75da0e7d9792e038a89c7
MD5 hash: e0cf678550eabb02e1a3ffc9279584b3
humanhash: maryland-glucose-quiet-mike
File name:SecuriteInfo.com.Trojan.Siggen9.56003.3620.25919
Download: download sample
Signature AgentTesla
File size:966'656 bytes
First seen:2020-07-01 02:05:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a771e77bca6b4f19f09073bbe6b405c
ssdeep 24576:LoiFbaOGF5vngqmJ6DuEwAy6dVKqQDpPhO:Lo7Fy6DuX6HQtPhO
TLSH F5259E22F6A14433D1722ABC9C6F9376583ABE003D28A9466BE4DD4C5F396413B352F7
Reporter @SecuriteInfoCom
Tags:AgentTesla

Intelligence


Mail intelligence No data
# of uploads 1
# of downloads 28
Origin country US US
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/18141/
ClamAV SecuriteInfo.com.Trojan.Siggen9.56003.3620.25919.UNOFFICIAL
PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
PUA.Win.Adware.Webalta-6854075-0
PUA.Win.Adware.Webalta-6862190-0
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/dcd8e02505929d4ef4a4cf57338688a12d0f012a6f4258cbe1999386172add07/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Injector
First seen:2020-06-27 14:48:26 UTC
AV detection:42 of 48 (87.50%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200701-nn1kq5elb6/
Tags:persistence spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 63.89%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe dcd8e02505929d4ef4a4cf57338688a12d0f012a6f4258cbe1999386172add07

(this sample)

  
Delivery method
Distributed via web download

Comments