MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04fd9df0e5ec9e9f2ddebfa497adbe3c57876dd52d8b778cee3701f21cf02986. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04fd9df0e5ec9e9f2ddebfa497adbe3c57876dd52d8b778cee3701f21cf02986
SHA3-384 hash: 6cd2732b1969506e2e6a125a257b06bd87096e09e547efc8254a8e865bc03f5fd15b53b85f394d277938c88c328970e3
SHA1 hash: 3f41f849c313bca1544141d0240c7c53df951dd8
MD5 hash: 2c6c3143b423c890e0d160e60bf9f2f7
humanhash: nineteen-friend-double-jersey
File name:jiz.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'544 bytes
First seen:2020-04-06 14:03:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:/qL9wWa8DyWmBbTQEHMIPdhlFlszZiRK8GzRWMbhNrYebJGheucfhUJ1PzbYy1SL:EeKEHv5s0GzvnPuxJ99JI++vbZcOk
Threatray 10'574 similar samples on MalwareBazaar
TLSH 53544BAD2B88B902F23D1D7289D1522512F2D4879D12C34F7FC84BEC7E717DA2A49396
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 06:47:03 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=at6z34hf5spj6lo6x6sjpln6hrlyo3ovfwfxpdhog4a7ehhqfgda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
180e63e884c208203b6f222673df84b703a55db642fcbc97183a979fc01381b8
AgentTesla
345ef8849cbe5eef544828b73480fdd7f64e2dea39c2764d5a7491878755118c
AgentTesla
4297b0f564c12f9b864cb9c48b6b408ca13349dcc557c3243fe398d4921a8a8b
AgentTesla
4b5962005864c7cd8c362e37987f7091991f6f3f0a992e02e1b51beb92292a5d
AgentTesla
4b7062e9320bec266f0634e17a82e44e5b4593b74242ef48c5f430d84fe9f379
AgentTesla
7a3ccb191798f72fb41fb65d66efe2ffc82c848bf1a6d96738a4834a51d71761
AgentTesla
7e674e875d063765fdbb9b7bb4ddffd35f1617a82099e7e791f8c8273c8e8f1a
AgentTesla
cdbbd0b8a60076d5acc56645fb9c09622e32b878f0a8c6201db7c87f5bf09631
AgentTesla
db183fbb41e6ac88f64e72c8b5b21ff971530789ff2ff1df1f5a8d8827b4ded6
AgentTesla
fbc8a4a7c795fa996462ad57db81b1b8c06e95cd9f6a6c0564c749682cdd6692
AgentTesla
+ 10'564 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/335772/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments