MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f477b7ef6ca897a504ad2565e80af6fe1cbbd6f25ffaf2e5c341528cf31c1dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f477b7ef6ca897a504ad2565e80af6fe1cbbd6f25ffaf2e5c341528cf31c1dd
SHA3-384 hash: e9b97e608bb6a260728aaae2a8958d440fcca3d7cc943b2260aa6ace0ec83d1c7ba792fd4ca889a852fb9ad456dcc69c
SHA1 hash: b594090a8e52129e797b930c701938a626f6c529
MD5 hash: e38d873b742f2089102c2955f9480e06
humanhash: seven-magnesium-oklahoma-quiet
File name:d35577a071eb96da61014b595499d1b7.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:293'376 bytes
First seen:2020-04-03 22:15:13 UTC
Last seen:2020-04-04 13:55:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:5IplMMIJNPECEPUMXvWmmvlqwg6dw38Aj7sCS0pyhEeKTNJxU7bH8muTVC+:5IpTIJNPXEMMXOtJg6doU1CTZjmuTV
Threatray 10'544 similar samples on MalwareBazaar
TLSH 1A54187C2F88F902F73D693289E1566012F294834D12CB0F6EC45BEDBE637CA6949395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1FTUB6V9CwU9trR6wX39rzyOx1eUG18Ev

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-03 22:35:22 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5dxw7xwzkexuuck2jlf5afpn7q4xplpex726ls4gqksrtzryhoq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0254f414295e7637c690312621a7b21586d531bdfe058abd870c29587890b72e
AgentTesla
0702729c34578ee78cf3cb883ee298fc4aa67dbb433981790605e4e4afb642ff
AgentTesla
4410537e13a01896bab12528953776427755829a7e483890aaafd04a12fc23ab
AgentTesla
66a2878b55d41d3e576ec08bb0e28573de3af9dbbbd08567cc730198a490d021
AgentTesla
83e53d7cb2f1c24c0d05496ef742d8e8584efc8261e4f915919c0029b35d2793
AgentTesla
8b067f96d137ec51a531cf8f63e4f1f635c0e34b3ef1959b5e36fee449b4cc67
AgentTesla
93be0fe8d21b3577152bf9083cafa6ac549ffd80ef37243f81bb6c17827b1ed8
AgentTesla
a8c64168f72d3a7af27ae6dfff00da04467744c5bcc04f9292761359e5507cbf
AgentTesla
af0e59dcbfdc7a8b1a13748ab6e392d165e6b91f0a1ac946b3ea7dc3cbb4fac5
AgentTesla
d1d14f8dd6e27ee5e2ad219935cbc367da9fa4659794bdf9938be7ffbb89a92b
AgentTesla
+ 10'534 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

103f3138a2d0ad13b4220fdd13d7ed39ac039498c7d7dfbbffe7972aee7a44a7

AgentTesla

Executable exe 4f477b7ef6ca897a504ad2565e80af6fe1cbbd6f25ffaf2e5c341528cf31c1dd

(this sample)

  
Dropped by
MD5 d35577a071eb96da61014b595499d1b7
  
Dropped by
MD5 cef2c6c2b56d0650c81d20b20da69ec5
  
Dropped by
GuLoader
  
Dropped by
SHA256 103f3138a2d0ad13b4220fdd13d7ed39ac039498c7d7dfbbffe7972aee7a44a7
  
Dropped by
SHA256 22fc734fbf824bd54aea48d4edbce981202af1ef19b9d93c8eb23949837878e5
  
URLhaus
https://urlhaus.abuse.ch/url/334744/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments