MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 143940bf5affcf82143d14f73a884baa3eb9e7bdde11f992d9147b9b7997a7d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 143940bf5affcf82143d14f73a884baa3eb9e7bdde11f992d9147b9b7997a7d9
SHA3-384 hash: 582641d61004443fd2451140d21a88097258db1a05188b2d4b09e7febb6fc00aeb85a98c322fadc7775ba0b374aaa748
SHA1 hash: e97b2daa997247de6955520df14a633ae1a3ac54
MD5 hash: 20ef7cbbe9109824f287a154b56adfd7
humanhash: edward-network-lima-rugby
File name:f12677b813d0b9a2f0df55d372dfb9bc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-03-30 02:10:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:66Xpzg0Fz9cLMWCpu6VEsnZ+AjF/EUVdhYTh9b3oeTV:66Xhg0tppuYn3Hy7oeTV
Threatray 10'468 similar samples on MalwareBazaar
TLSH 4B54297D2B88B902F73D593389D17660A2F194839D12CB0F7EC41AFD7E527C9284A3A5
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1rm8bATG9fHKH74dXAzBxYm7DRGTpI8Bb

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 02:35:27 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cq4ubp2277hyefb5ct3tvcclvi7ltz553yi7tewzcr5zw6mxu7mq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0cf4378a60635fbed046a2afa593ac87c02b814cb0f2760fcf475d2abedfb12a
AgentTesla
0dad541bfb58986d8e53cf1ebb05c9eced195bc4971283098f8459670545682f
AgentTesla
16a33ff1076ad51388af14a2f735a4de0a205a6a2a658598e11225368d686c10
AgentTesla
430e12161cd33ef55da30dd43639bd7924009a568d7ad67513d0051f63ae26c8
AgentTesla
464be33bec927be20a7a20445cf668ccb3ec05e76695ce7980b5e6841a02c0f6
AgentTesla
8501b62ef01d0a8ffacb3e1c7bd13129fca8a621d00f14d81a1227cf6872c5fe
AgentTesla
976174c0ffcfd0cdeea0a9dd962b995142d15a1cc831a42c68e7b3f928bd7c3a
AgentTesla
e93f94c0bb264f3323526dcdce4efcd7e74a95f8d5b2609463a5d27c4b1200cd
AgentTesla
ea39c891ee5af5b1c5d76cb6cfb76cd18e160160fd1a5fe34deec0d240ec7a87
AgentTesla
fa52701034f5b40937afd001f26baf9a19b21cf44c5eb6f35f3b8afb41865efe
AgentTesla
+ 10'458 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

4016056939b926f9b8aebb651d1cb720cc826c656978becbf259b45bc45169b8

AgentTesla

Executable exe 143940bf5affcf82143d14f73a884baa3eb9e7bdde11f992d9147b9b7997a7d9

(this sample)

  
Dropped by
MD5 f12677b813d0b9a2f0df55d372dfb9bc
  
Dropped by
MD5 fcdf93fe8877f517c1af5910dcd38885
  
Dropped by
GuLoader
  
Dropped by
SHA256 4016056939b926f9b8aebb651d1cb720cc826c656978becbf259b45bc45169b8
  
Dropped by
SHA256 72c761457c1128dfdb31abf4fbbfffc6dde8c843e95454c91a673528b283804f
  
URLhaus
https://urlhaus.abuse.ch/url/332085/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments