MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 068f081a67c4f35c9dc6a3e2f0e6a006388de73c789d1dd277615016a0b506a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 068f081a67c4f35c9dc6a3e2f0e6a006388de73c789d1dd277615016a0b506a7
SHA3-384 hash: daa29de837a8adeb881e2b140bc5bea5056df77990dd6266365fd5cf0b10685682b3d9f6dabe9d82ae2235ee2e3ca5a9
SHA1 hash: 6cff011e004f2712149e5751860e2082d352f6fb
MD5 hash: 8367c1f992dc477bf4065f832e8f347f
humanhash: nebraska-oxygen-fillet-two
File name:dd4fa26acc9b2773d3a056c58eaa176f.decoded
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-03-26 13:45:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:cj9TkjeKoiPVxA4nkbulBYPbgccGD8l8Hgpb9KoGTV:cZojWi7gSmjgOoGTV
Threatray 10'411 similar samples on MalwareBazaar
TLSH 14542A6D6F48F902F73D5D3249D5666022F290834E22CB1F6EC85EEC7F527CA294A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1RB0Li8b6bqfr0jUP1E_aVQms_YDIkvyO

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 13:48:06 UTC
AV detection:
26 of 45 (57.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2hqqgthytzvzhoguprpbzvaay4i3zz4pcor3utxmfibnifva2tq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
161cb9d75e6cb025a001bcd3a6e7d45adf3837d3400344c2de7323404278f2e3
AgentTesla
16a33ff1076ad51388af14a2f735a4de0a205a6a2a658598e11225368d686c10
AgentTesla
2ac0c34c2f1ac910d5147ba24aeae1d279252a16f195aafc997215b4491b52f0
AgentTesla
430e12161cd33ef55da30dd43639bd7924009a568d7ad67513d0051f63ae26c8
AgentTesla
71adf51ec259c30843476c3a6eb3318ec9cf7ab8d4d4f1121b0f11dfbef62694
AgentTesla
976174c0ffcfd0cdeea0a9dd962b995142d15a1cc831a42c68e7b3f928bd7c3a
AgentTesla
ea39c891ee5af5b1c5d76cb6cfb76cd18e160160fd1a5fe34deec0d240ec7a87
AgentTesla
edb8c081034a6b1e130575163fcf1ace66ebd3dc18bcfc634ecc0f6949b6ac54
AgentTesla
f14e610ce7a0f34784a09f45d686d3509c7bc53d0a0c7fb88427d650b44ba8f5
AgentTesla
fa52701034f5b40937afd001f26baf9a19b21cf44c5eb6f35f3b8afb41865efe
AgentTesla
+ 10'401 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

d437379b30307a52034aed618fdb773595e6e0d7f28f9fc6b47d7d30f27e63e0

AgentTesla

Executable exe 068f081a67c4f35c9dc6a3e2f0e6a006388de73c789d1dd277615016a0b506a7

(this sample)

  
Dropped by
MD5 dd4fa26acc9b2773d3a056c58eaa176f
  
Dropped by
MD5 bbda9920c99a34c94b6dfc15bacabc06
  
Dropped by
GuLoader
  
Dropped by
SHA256 d437379b30307a52034aed618fdb773595e6e0d7f28f9fc6b47d7d30f27e63e0
  
Dropped by
SHA256 b845b158a7b521d119079c09a17995f4c099948eb5d31b7bf8b27002d8bf3437
  
URLhaus
https://urlhaus.abuse.ch/url/330432/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments