MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5cc23bfa0f9589308e2c6b099bd6400687ac3670cc9cc6e13bc6d671ed66fce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5cc23bfa0f9589308e2c6b099bd6400687ac3670cc9cc6e13bc6d671ed66fce
SHA3-384 hash: 7bdde15bd1c9f85c7a5e99874bfd07b2b90fd5c73e12d46e20f7d7c10291ecf9b21303f5d3eafb96d9a8a5f5ec0f3b41
SHA1 hash: 5f404fc9c1c557b9c0e70bbdcc47129cb025cfdf
MD5 hash: d06311fec464c591aa7dba3f35e880e9
humanhash: coffee-tennis-speaker-social
File name:d06311fec464c591aa7dba3f35e880e9.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:618'496 bytes
First seen:2020-06-10 17:51:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:0/YVt4iz3bn/cKZJBnKQXD0WuVQhciZ3/kZZUjsoxpQMXJT86uK0zEm+:UY7dHZJBVXgac2TpQ0J
Threatray 3'535 similar samples on MalwareBazaar
TLSH 44D4DF0436E16E8EC76E8DB6491B18105BB065273E2BF3435CDF26DA146DFCA4A44F8B
Reporter abuse_ch
Tags:AgentTesla exe


Avatar
abuse_ch
AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.jc.4903.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 16:41:34 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xgchp5a7fmjgchcy2yjtpleabuhvq3hbte4y3qtxrwwohwwn7ha._file
Verdict:
malicious
Similar samples:
083c70afde1be48426ebcf28eacfa0cd47f96130790b79f5a367ae6b00eab142
AgentTesla
21cf18a3f7318d77dbab369b9095a9f18a5e46b6b99608d5a3d69c3ecd70be06
AgentTesla
305eb08e59ef7e93a40e6eb8edf0c4a336ff54bfc07cac69d1744c949f53757e
AgentTesla
5f2517598649fe78e58966a15e9fea89e43ee57aa0ad6b779ef18be53eb39a2b
AgentTesla
6d54c4bdd7149e81dc967e55ae893f4120d53d511253f829ae6881501b0a18ff
AgentTesla
872e06d165968c0548d362d26c3c05ba9c3f35fe1066c5623dded0dd7cbb92f2
AgentTesla
9b5b44ded4ede28d92834c4db286780a5628d02597a739ff3633f808d47f0939
AgentTesla
da5b47ddd8d07eccd9cbe46fe79214834b10b19aa3dcf6e7bd11d4681d9e5177
AgentTesla
dbe1a5d707e204f1892049708408cdc714d043cdb1bb481e67761346db106bcf
AgentTesla
fca57bc3188f4383efe5bfd8a6c0e3058273c7dca96ef9360f6290790f8883b6
AgentTesla
+ 3'525 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-vnn878beme/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments