MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146
SHA3-384 hash: a14507bfbf61e2d53e22a78db401bbd68f3610090ca9ed42371e68e604e807e1fd152c8f8fca9edf1b108c49043161d9
SHA1 hash: b5ad16a4dfe64a94e260effb6ff9052f6341c99d
MD5 hash: 4fdec4cf21511060ac0dca9fba5637c2
humanhash: oscar-coffee-tennis-fish
File name:Invoices.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:81'920 bytes
First seen:2020-03-20 11:05:38 UTC
Last seen:2020-03-20 12:39:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0f0a05975c626aa350882208bca14b42 (1 x AgentTesla)
ssdeep 768:1eRSZwUFFLmg8JJOIwOGNZ89g0bHeaL5TNzjTUerlk5jzjQmGMyt+:1eR+PFT8JkGG2gOTNv5y5jhnp
Threatray 725 similar samples on MalwareBazaar
TLSH A9836C56F760D826C868CB3E2C99D6D031237D956A92DB8F3B947F1E64F0192CE1CB18
Reporter abuse_ch
Tags:AgenTesla AgentTesla COVID-19 exe GuLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.VBGeneric-7639434-0
Create hunting rule

Win.Trojan.Vebzenpak-7639767-0
Create hunting rule

Win.Trojan.Vebzenpak-7699953-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-20 18:52:00 UTC
AV detection:
26 of 30 (86.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qrh3bvq76k7fmbbzcr4xwlqbepqrd5qwxpluhy7m73s4gqdfcfda._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
guloader
Create hunting rule
Similar samples:
032624661ba64ab1c3ca40a7a47b3635ee6b6a3442ca6bfb7a41a4a8de7b0fb5
AgentTesla
27d318fe5d1d8f02c39b6b82690e4be83eeb3f357618cbabd7d808a23924b277
AgentTesla
2bd30faef9e89799bc33f076afc8f3521bc84018c8e27829e8f475ee1c8dc13b
AgentTesla
3df464cdb09ec8aed7589b31541a291c9b921f49b2cc97aa34d363161366db8a
AgentTesla
4d0dfe01c27dfd2c35464a3f435cfb4cad6e996d6fc407cc8f10fc0b3d0692fe
AgentTesla
4fb3528f5fc1a30b03cf69920e1db68cd4943c1c303a09cac0723a10abfcc378
AgentTesla
5cd5f57afb04ba3ce4e5aaee5a7fa7d10b24a334e30911a49a4cc4cb52982848
AgentTesla
65bd5f3bc433f60bfc5ea392aaa33539592d657cbe2d316b25b24c9e12c225cc
AgentTesla
a07051295b50dfe762f42e922f6815e4554ae1b392da5810b88893cb91ac3b7e
AgentTesla
c76654971c4af60511d3583a3bd00c673904569aa93973687e14e95b9e80de6f
AgentTesla
+ 715 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1

AgentTesla

Executable exe 844fb0d61ff2be56043914797b2e0123e111f616bbd743e3ecfee5c340651146

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/326937/
  
Dropping
AgentTesla
  
Dropped by
SHA256 408bde2024c8b5840b9301dd0537f67a4aa269c35acd603fa04c8875cea88cc1
  
Dropped by
MD5 7135da289d6ab6ec8d490b6439fb6f3c
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments