MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cf059a1d51541e4a746e4f8f624152801c40489e612bb46abd6a4bab26f6851. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cf059a1d51541e4a746e4f8f624152801c40489e612bb46abd6a4bab26f6851
SHA3-384 hash: c827c6ab0628825c90f5b313d48d8e976169a784c07aa4faa67ba779037336e067a210f2b1ab5a3d936951ff7aef65b0
SHA1 hash: c917d8848dc2116826d41bd3eccc4f1a3d5c829b
MD5 hash: 5296d690d6410e1b57c6cab4afa72d6c
humanhash: bakerloo-batman-failed-may
File name:fd7193638066490a022e7d9443253d38.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-03-26 15:45:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:lNDbdQoOW2V0tKjbqvO5OTIWnLMblWLOw9U9GzmbBoeTV:/bNOItKqJSIN9GoeTV
Threatray 10'495 similar samples on MalwareBazaar
TLSH FD54297D2B88B902F73D5D3689D1266022F1D5834D22CB0F6EC51BED7F5A7C9284A386
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1TuAJ1cXDkEMvisFnDalV45NB0YQuWfPJ

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:36:50 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ptyftiovcva6jj2g4t4pmjavfaa4ibej4yjlwrvl22slvmtpnbiq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2836e2f050c5ed948fb0652dde8eca6e867cb25aaa835d8b58738ec251dded5b
AgentTesla
39d0047c0a981b1d37d189f0e466fdeccf3408591d44bac4c549af7cee83fa69
AgentTesla
3b579b5c48b467cb0e3a3b28773a63ce90b11a87f4baba15b98d0af36291a314
AgentTesla
829008943eff3aa587242f2dda6989e2f2b1e7cf7abcb10099071aa2444a9cb8
AgentTesla
8f8f28f5eee0d7e5a4bf151528beb476347dd84c94ef721675237f00e391c6f5
AgentTesla
c7839a3137610ece15b06c73cb4e9ad2b7d175630c13717649974d1965d1235c
AgentTesla
df4a4e6430488397eecf551b6f8558f71d5bc65fe78d70cde3d45e38e82d82f9
AgentTesla
e0d1c1f7fd8a8d07882ceeb4d681f9ff2b36912e9b0a8b182b3252599c2ea699
AgentTesla
ef0e3fa0b391bdc3f8a6314ba3ca48cda4cea5a8e8e75f81681d70eaf4f3e39b
AgentTesla
ff4ce18a829161a6d3e62fdcc8ae87d234b8b964abf8e7cddb9f44e761ae4a7d
AgentTesla
+ 10'485 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

05c3e336c54d8b6f8f031cd794793fd519e02f6ffb785f93c96be38cb0de0e94

AgentTesla

Executable exe 7cf059a1d51541e4a746e4f8f624152801c40489e612bb46abd6a4bab26f6851

(this sample)

  
Dropped by
MD5 fd7193638066490a022e7d9443253d38
  
Dropped by
MD5 64ad7988ebc5ca332fc671f7534a32fc
  
Dropped by
GuLoader
  
Dropped by
SHA256 05c3e336c54d8b6f8f031cd794793fd519e02f6ffb785f93c96be38cb0de0e94
  
Dropped by
SHA256 b35c9b128d8bd7c6ab23f0305189679528bf79b4c53a0f96106433c1e31ecb1d
  
URLhaus
https://urlhaus.abuse.ch/url/328841/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments