MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe3e525b56aaa99c9716eb9a4b7a1884e8b1f35d38388268f627485532f25d60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe3e525b56aaa99c9716eb9a4b7a1884e8b1f35d38388268f627485532f25d60
SHA3-384 hash: b86c2633c0b3540d9858640f056d6f4bdd6b30b5d779b9aba11cd966d170ac61579c1b354b84a5726040c54f2fbd4845
SHA1 hash: bb56aaf65113fed4f057106a514e4fde6026ea7b
MD5 hash: 6471313708b08e04994061d4d4d6ffa0
humanhash: ack-high-butter-delaware
File name:http___newexchangefileservicepromotion.duckdns.org_akw_vbc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'129'408 bytes
First seen:2020-05-13 13:37:29 UTC
Last seen:2020-05-13 14:51:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:RKLt+G9iIBLgD0AjuikU9AZl1JlRqo7DgqwKfXuR6PcqVO7kRrIFc54s4u11BtBB:RKLt+G9DUD0AjuTYqww+wPcsDou11Bt
Threatray 172 similar samples on MalwareBazaar
TLSH 57A53C0362C4EBEEC50667B45593855C0BA0F6212662EF4BCDEF71D66E212E209377E3
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Autorun.Spy.Agent.DF.19388.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 14:01:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
6
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
066752bd623ba4401c4f223b1d7d3367095632159cf758327e6fe7025d5d9a3c
AgentTesla
0d179277dc17521d3f9668838ddc6cfe818f72ef5691c123443b9442295d90ff
AgentTesla
55bca504c5ff798d6c5d4431eff4dda8df6ebfca0db4d86b0f1bf770ff550a0f
AgentTesla
686a4b97ac3658409328ff06350a2af5d637cbd7bcd6ae9b60d80f52244a803b
AgentTesla
723080f3083b8428248cead3d4c3ad20883395e1d574f853bca15065d2217fad
AgentTesla
82f9d45ee92a5f51af44dc11384e5a10fa12fbb46659291dc188a9222d17fc34
AgentTesla
cb8cf6b203f27f3b42020653f940d2be826893d079035eac52d4d64e1102aa29
AgentTesla
cf1e8f2fc2dd05514be3e8f92abf5b266dfb1547cc611dabc0cc4eea5a1b7dfe
AgentTesla
dbeb99d2b3f5ab13560c96f80ee6153f909f64aac45d4ad56e2468320430acd3
AgentTesla
ef0116d9f61a26ad233dc3edc1990eb6c83b0398a593c65ef19f106008892eee
AgentTesla
+ 162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-27kwkpadjn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments