MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a2533cd12641545086ee338ed73a19d36ae241215ae553cf32a6c89794ae938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a2533cd12641545086ee338ed73a19d36ae241215ae553cf32a6c89794ae938
SHA3-384 hash: e4ffa6db5f7551ffea26735a0fac21d877e2590a57195824f38031564db194f49910a10535fed30b8e21f6d51f35c87a
SHA1 hash: ba797eef4637c520c657a03a6ca512ca7586846c
MD5 hash: 09d7adf3dcda5ce14ea85d68540896d2
humanhash: may-carbon-london-thirteen
File name:97f46f198fb3becde41938ca58d0cf76.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-03-31 20:30:11 UTC
Last seen:2020-04-07 12:24:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:JEJxkmX5QWLAPwlv/7vkHEuWpJekEMwYTbbMoWT7:JEJxNQIlXHEMhcoWT7
Threatray 10'520 similar samples on MalwareBazaar
TLSH B5543A7C2B88B902FB3D5D3289D1266012F195834D22CB4F6EC45EED7F627CA2D4A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1to3LFtEF4XhtcyOsHxt5hQKvIWn00gEN

Intelligence

File Origin
# of uploads :
3
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-31 20:35:26 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pisthtismqkukcdo4m4o245btu3k4jascwxfkphtfjwis6kk5e4a._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
01aad6e3d5eaf5e4e177fbb2ff8c48214b2fad16e12aad163de371602be40103
AgentTesla
133a4e4836245a58ec3415472f0f2c31c40c2c1f013321d77af5d6e6d1c1dea7
AgentTesla
721d621d895199358641b0e95c31e543ce050ad4447f8f2255bb9f9c110e1c93
AgentTesla
790ddf3ff510253b5db189de93fb5e43fadc838d1c254d1d7f5236473e43526a
AgentTesla
7e5d0830e298b53def4937670537c57e60296463a96e97ebdcd2513343c7232e
AgentTesla
913c3c055acbcc86b156ce14faaac21a4aeb2aa884c4968397b632d143fe318d
AgentTesla
9dcc55371b4e6c9419e6b34fb4501400c6efb5515aef424349e7c845ddbf47df
AgentTesla
a47b392ee3749782644cea8b41967b05fe9e7d76d75dcd2888e5ddc75f9963fd
AgentTesla
c7d61fee58d6bb0e581f517fff6ab3c3738fbb12a261e3ce10c525d18fc1c1a9
AgentTesla
d613a44287461721470462f057542daf34dc32d8e1d66cceb8837fc379c36c7c
AgentTesla
+ 10'510 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

bb33b2344ff1837bbd2bf986229b30d7d2089bd64b74637ad02e5440c9b0bf13

AgentTesla

Executable exe 7a2533cd12641545086ee338ed73a19d36ae241215ae553cf32a6c89794ae938

(this sample)

  
Dropped by
MD5 97f46f198fb3becde41938ca58d0cf76
  
Dropped by
MD5 db6342067979eb3d645b6b6298f8b4e3
  
Dropped by
GuLoader
  
Dropped by
SHA256 bb33b2344ff1837bbd2bf986229b30d7d2089bd64b74637ad02e5440c9b0bf13
  
Dropped by
SHA256 5282faecfa696e655f65fe912f83afc233cb2704d10ff9da88486c1658816865
  
URLhaus
https://urlhaus.abuse.ch/url/333127/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments