MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb021aafa1c9baf15ea052eb0677921d08c6d4813982e9a59503975e784c1d14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb021aafa1c9baf15ea052eb0677921d08c6d4813982e9a59503975e784c1d14
SHA3-384 hash: cec28c95e8544bf87e9b549de78eff9a349d2be7ae3f8a41206035248b5cf51b78ec79be91ab44cc2555daeece4b9bee
SHA1 hash: 023ae4cfe8d1fb9fc12f6102906f346b3d45e589
MD5 hash: 35d3e8231e2e4a545da3be39d1d0119f
humanhash: kansas-river-juliet-illinois
File name:PO-20004015 pdf.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'144 bytes
First seen:2020-04-15 14:19:23 UTC
Last seen:2020-04-15 14:53:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:zpfAHAaWBXRoDwxFJIVeqZmFUOppwe2KUzENKrD0VxGl3ON6VSk6tkR:9VxfuR8wexgIYM6WCR
Threatray 11'131 similar samples on MalwareBazaar
TLSH 18A48D6E678CEEA9D737F774440721918025F0C32DE6F61BDF8574848A02D8C9DEEA92
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.6024.3852.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-15 11:34:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 30 (90.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7mbbvl5bzg5pcxvaklvqm54sduemnvebhgbotjmvaolv46cmduka._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
096ae460e33908d00c783f2f84b2f6b33d46a471f0bdbe713488b850c5565a38
AgentTesla
125da1fd4c66a6d1a0cb3a188173e53d7cf563c1f8c6bdf157b2c4195c169466
AgentTesla
4492477085185c93963a539b53e4b5b13039562d20131a9a6764c62acf1c8e25
AgentTesla
7a27c2b1dde4a2dafa2a6d8e984337a891d4f7c1a15a80c5524be3bb5c0ccde6
AgentTesla
894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f
AgentTesla
9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
AgentTesla
c5c42dcb374ab7399ece0408c92e2472f40ba9810a78f920ec996c9094a09e9e
AgentTesla
c615feef9580a0c5da27cffe236ad0ad2b86c511a51e92b782f8a4f58b617085
AgentTesla
d1931549889314ea581a097b46eb2ccb8dbd08d7da7f7695c5eac9a6854faa3a
AgentTesla
ff278ebc92da79938de3a3e3efc7189862cd88d282b6a672fe94232279851be1
AgentTesla
+ 11'121 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments