MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b54382eba3263ce82d5c895230a9b1dc922b245583400c62f425b0b25119679. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b54382eba3263ce82d5c895230a9b1dc922b245583400c62f425b0b25119679
SHA3-384 hash: 8830d5b1608b8420c48580069e1006472c4b5a9c925cb8b54e4e4892f562d539803bdd3419a7e5eeaf5d60d2fa377c38
SHA1 hash: d842f7924b5b041be03564b293a24bd925d8bc25
MD5 hash: 3f95d263d1ee95ea89253542e832ce37
humanhash: vermont-orange-queen-undress
File name:thai.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-06 14:04:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:i6LWSFJcFeJZH/fQT4Adzh5DI9DHccLbiKVI++LbVCOK:1WhwRo4AdzENcYbNwCOK
Threatray 10'689 similar samples on MalwareBazaar
TLSH E85429BD6B98BA02F23D4D3285D5522412F1D0838E12C34F6FC45FEC7E697D92A4A396
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 06:10:17 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rnkdqlv2gjr45awvzcksgcu3dxesfmsfla2abrrpijnqwjirsz4q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
23fbda6615005156d204371982d99be45fea990cf58dd637d8e5ec6550347346
AgentTesla
254c1b8ff86ebe8a88aacb3172ea4c05289dc129d3364189bcdfd097e5f5ef6f
AgentTesla
2e5bcd2bf5dfcf1c5ae278f7e725ed488c08323b485b1b5676b90085bf2bce0a
AgentTesla
5195a4cafa2c4a637c0170a5d2840cbe6368489962568eb4676eed5bff50c6a1
AgentTesla
5982c804cb3b2c334a54049f3883256169b7e406c2ec275cf3752119110e6382
AgentTesla
9473ba282d493f6b4e5eddcccddc1e998b3c2d215801cd94cb793b36d1c6b71b
AgentTesla
9ebeccf2c2b987cf1506b20018874f44c8aa28c477cf33dc4f6ca45bb7f25a9d
AgentTesla
ca8bee78548af15a74451cdf1b85cd25033cd76d340f974d98b315f2d4cc7110
AgentTesla
cf8d156365a4b9dc81ff3dd651a4b287f3513c4fc1784111eaf6bd13b2f3e91b
AgentTesla
ff0b6df1ebbe0c832da7869563f4ffd729fdc190e620347ac93b5d2cf31896ae
AgentTesla
+ 10'679 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/335774/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments