MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e654eb888cf345f65b8363a808a86111d1c0bfeee51a78b0d0c756a7f3bd4c0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 13
| SHA256 hash: | e654eb888cf345f65b8363a808a86111d1c0bfeee51a78b0d0c756a7f3bd4c0c |
|---|---|
| SHA3-384 hash: | 55b9013b85499b0127b577a6d5f459904f799d05f578f336b1c133b214b6a40094d5eafdfc95715c95adcfcb7a856bfd |
| SHA1 hash: | 5c0b7d1c758cdfddcec810c429e98be0d01c2980 |
| MD5 hash: | 24f92a7026c840f4a49363015754f58b |
| humanhash: | butter-seventeen-lemon-uranus |
| File name: | 24f92a7026c840f4a49363015754f58b.exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 434'097 bytes |
| First seen: | 2022-03-31 09:26:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (728 x GuLoader, 452 x Formbook, 295 x Loki) |
| ssdeep | 12288:YNPBHFLe4etPW0LMvnSSVcuJfHLqbbiLc:YNPBHFLe4T0LlSVltEac |
| TLSH | T17494DF567B50C967C8093B30ACB7AB746779EC41F9E6470B3688FB4C7DB17A899042C2 |
| File icon (PE): |  |
| dhash icon | 0c7cfce8a8d4e030 (1 x AgentTesla) |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process by context flags manipulation
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
AgentTesla
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Threat name:
Win32.Trojan.Nsisx
Status:
Malicious
First seen:
2022-03-31 09:27:06 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
20 of 42 (47.62%)
Threat level:
5/5
Result
Malware family:
agenttesla
Score:
10/10
Tags:
family:agenttesla collection keylogger spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
3f919539842c450326e1ece78844c6e98a850b7cb1b41e249e9c235734d605f7
MD5 hash:
2934e38e9bde36e0dfba2f39b96b2f04
SHA1 hash:
21cb63fd9407ff0d5d65ee39a5328ac6c99659bd
SH256 hash:
08c6dedf958d8ef831d588cbb98fa5e7f7e05f8b5d020c60f85d374511aa9102
MD5 hash:
8225b4ef1537395fe9ca131692849f87
SHA1 hash:
117020a929e3bb2fa8fe59772b3db86a92512c3e
SH256 hash:
c3be68a99a568f4347309859aa650846df8ebfeb0114187dd48600672e18c1a9
MD5 hash:
f1c496a63eace805d83f972f0c4ab3d8
SHA1 hash:
0f002f8bb3527b7d33694d4c4a80991e2511c286
SH256 hash:
70801d207826cdb9c116cc7e5a8d6df35b5ddbc84d529a2e3b9671aea27a4dc1
MD5 hash:
166987a23a707850da170cf8d154a601
SHA1 hash:
191ad60205f8151d1935c3ca7121ec163aa55e39
SH256 hash:
e654eb888cf345f65b8363a808a86111d1c0bfeee51a78b0d0c756a7f3bd4c0c
MD5 hash:
24f92a7026c840f4a49363015754f58b
SHA1 hash:
5c0b7d1c758cdfddcec810c429e98be0d01c2980
Malware family:
AgentTesla.v3
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | ach_AgentTesla_20200929 |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | ach_AgentTesla_test |
|---|---|
| Author: | abuse.ch |
| Description: | Detects AgentTesla PE |
| Rule name: | AgentTeslaV3 |
|---|---|
| Author: | ditekshen |
| Description: | AgentTeslaV3 infostealer payload |
| Rule name: | MALWARE_Win_AgentTeslaV3 |
|---|---|
| Author: | ditekSHen |
| Description: | AgentTeslaV3 infostealer payload |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | win_agent_tesla_v1 |
|---|---|
| Author: | Johannes Bader @viql |
| Description: | detects Agent Tesla |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.