MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 296214059663fa3e1243f126c2cf5f689ae0cb91324a3624a97048466b92f875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 296214059663fa3e1243f126c2cf5f689ae0cb91324a3624a97048466b92f875
SHA3-384 hash: d2d03b1d60cba5db025d4043ca9b59930209604abea4923d55a8a918e8dee3ad49b892aa09dc08e6ec58172462bc00ab
SHA1 hash: 7be2edf62acf094ce06e5fda7b2c5e347a07577b
MD5 hash: 7d5ced434246a3c96f52e6faf3f03761
humanhash: johnny-romeo-florida-oklahoma
File name:8be60a1670818187da897e9f670e3839.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'032 bytes
First seen:2020-03-30 08:30:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:+ajdveXajTWXL6nVZtz7F3OU8QyQdGy8pD6Gf/8Lb:rmauaBHF3l88c
Threatray 10'543 similar samples on MalwareBazaar
TLSH B8543A6C3B48BA02FA3D5D3249E1266122F195874E12CB5F7EC81EED7F127CD284A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://elintec.site/KEY22_encrypted_B50C29F.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 08:35:32 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffrbibmwmp5d4esd6etmft27ncnobs4rgjfdmjfjobeem24s7b2q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
17bbea6ca05282ea03942ee0ace1d10acaa2fe617623e552e650079bf6586d11
AgentTesla
342cb45a17253c6e1a88c20c3705beabc62c44844285d499f4be6eabf9720034
AgentTesla
6987e9d66b3d7120047b8725caa87c262f1430a2b91a6d1ef717e6f4b6c3fd84
AgentTesla
829008943eff3aa587242f2dda6989e2f2b1e7cf7abcb10099071aa2444a9cb8
AgentTesla
8ef454e63b8f837f990d0fc662e67b5a5f9c369a9fd01495419e13a053883536
AgentTesla
9f7264f096d9aa3d9bc1215a0979566e9fdc64dd58089c7913af18e2709e3f60
AgentTesla
a93c824d20b6d30f7a6cdd41e83dc2ed1b1294c023d25184b2779cd0fd4f2a5a
AgentTesla
bfbfdc4aa175409b4354617bccfd96fe232ce53601cbe98738f819fcde8837f6
AgentTesla
c2aece4c0138a4ce56c8baa129b99e8740277795ac3c69e03d3a86cb7e629582
AgentTesla
c7839a3137610ece15b06c73cb4e9ad2b7d175630c13717649974d1965d1235c
AgentTesla
+ 10'533 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

df34cfa12098874ae8a9d3107ccb82f1870a3d1ee8f8d4f6661cfc8bf1e39bed

AgentTesla

Executable exe 296214059663fa3e1243f126c2cf5f689ae0cb91324a3624a97048466b92f875

(this sample)

  
Dropped by
MD5 8be60a1670818187da897e9f670e3839
  
Dropped by
MD5 7db1cc8b5d2024cfb009162bbc833dfc
  
Dropped by
GuLoader
  
Dropped by
SHA256 df34cfa12098874ae8a9d3107ccb82f1870a3d1ee8f8d4f6661cfc8bf1e39bed
  
Dropped by
SHA256 f4e1a19777bf9a51f1aba10329ec70458319235619d3185b8771cb1f9c96e9dd
  
URLhaus
https://urlhaus.abuse.ch/url/332050/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments