MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f950a2dbbe8645cddceca51c978326425e9aaf7c1b59bab68b69ca2f649560be
SHA3-384 hash: e42c0b1c3df26f6007a4114193d5909168c0cd4e7fa1ffe77a7f49e6886283bd43d2eb60a7e06e9fb91d3b8f52800e40
SHA1 hash: d7c66601bdc76c8b9beef4f5adae87b9baa24705
MD5 hash: c6634a0ae2dc75e9806b0b9ad9a54be0
humanhash: hydrogen-wolfram-happy-cola
File name:company profile as requested and Purchase Order .exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:456'192 bytes
First seen:2020-04-30 15:19:21 UTC
Last seen:2020-04-30 16:05:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'853 x AgentTesla, 19'780 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 12288:LIfXF3DmfnsfzbH+T3NXNSQpbjgNyY6AMH1mt0y:aF3GsffH0dXNSQpbjgGTu
Threatray 28 similar samples on MalwareBazaar
TLSH 35A402615E78A73BCD3D07756471336543B24ACA26B3E32ECF8C24581CA7F6A196078B
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Heur.29647.14078.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 13:03:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7fikfw56qzc43xhmuuojpazgijpjvl34dnm3vnulnhfc6zevmc7a._file
Verdict:
malicious
Similar samples:
0af44b9553823391f942810e491b2160386c70982d0ee3e5ab745ae161f7572d
AgentTesla
1da6d8cdbcbc126bb0e5f21e8e4678fccd0e5ada916a304ba48c473a3e674666
AgentTesla
1dc7b9bc7fc4e17e45e76dfb99d0106802a503fcadbe1669a0fff3499a55eade
AgentTesla
274402fb25f2eef022a8c983908731a36aeddfe2f547057ea6c2e172a8523891
AgentTesla
48fce5283ce4cc7338411ae3d2b3d4c9dbd6d522f2f8ccfc63c2705e007364fe
AgentTesla
689fb0d1419bb3010bb280fcb9124931cf780afeceb1f2c455d146c40bbeb4a1
AgentTesla
6f638140923eb201b19d8f2be1c73e16294a06e2ee21cb2b74099416380f4907
AgentTesla
7af2440f0716f18f1d20faee99d68c25bc6e4a3eff067e759d2167aa5211221c
AgentTesla
c599667585688c32aa84ecbdad1a01e93e4a92beeab76c48f1f415234ce26b6c
AgentTesla
d36325c4e5d94107b550c1bea0edb4f5e6854f83ee11294685a337af71683f6a
AgentTesla
+ 18 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments