MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff278ebc92da79938de3a3e3efc7189862cd88d282b6a672fe94232279851be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff278ebc92da79938de3a3e3efc7189862cd88d282b6a672fe94232279851be1
SHA3-384 hash: df490e1560aab6652555e497b6cca3e382b35aa054629070c606ac6119de34c03420018ebefd67225138bb2aac530fd9
SHA1 hash: cffc8e9011fcb2f5db723a05b0b80f9dfd76f27e
MD5 hash: 3817c6c7772a5808996d27d9642826a3
humanhash: fix-massachusetts-beryllium-july
File name:ff278ebc92da79938de3a3e3efc7189862cd88d282b6a672fe94232279851be1.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'144 bytes
First seen:2020-04-17 09:50:32 UTC
Last seen:2020-04-17 10:42:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:6QErpu+D0rqbMXc9PJAYpND+c0K9xBC6veEtKFwG+enTC2OWupzskMc2Jqi/v7B/:66dc9hAYJJ06ztKGgnTgGg+v7i2Av
Threatray 11'186 similar samples on MalwareBazaar
TLSH ECA46C6677CCEFA1E7379775440B10918114F2C369DBF67BEF8074E52902DC808EAAA6
Reporter JoulK
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.28163.15387.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 00:27:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74ty5pes3j4zhdpdupr67ryytbrm3cgsqk3km4x6sqrse6mfdpqq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
096ae460e33908d00c783f2f84b2f6b33d46a471f0bdbe713488b850c5565a38
AgentTesla
125da1fd4c66a6d1a0cb3a188173e53d7cf563c1f8c6bdf157b2c4195c169466
AgentTesla
4492477085185c93963a539b53e4b5b13039562d20131a9a6764c62acf1c8e25
AgentTesla
754fdfd0924f05f11304a3131e908eb9189b31a2d30d50be50420853290bf709
AgentTesla
9b8107f42878501861702cac98baea7034b91231b362ce08741479aaf7c6cf4d
AgentTesla
c5c42dcb374ab7399ece0408c92e2472f40ba9810a78f920ec996c9094a09e9e
AgentTesla
c615feef9580a0c5da27cffe236ad0ad2b86c511a51e92b782f8a4f58b617085
AgentTesla
c8718b1795499f8f6958c2665914bd1320a4a3a6b039f00d19ab7ca283ffb968
AgentTesla
d1931549889314ea581a097b46eb2ccb8dbd08d7da7f7695c5eac9a6854faa3a
AgentTesla
fb021aafa1c9baf15ea052eb0677921d08c6d4813982e9a59503975e784c1d14
AgentTesla
+ 11'176 additional samples on MalwareBazaar
Malware family:
Agent Tesla v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ff278ebc92da/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments