MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9432700f59bd672129949d730c2a2319ac756fbeed838b0790f480e5b2975e69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9432700f59bd672129949d730c2a2319ac756fbeed838b0790f480e5b2975e69
SHA3-384 hash: 94f8b155392121cf5dc9c6ff394dca4964935c71a6e0c219d81250069d5ff86bd2688436215adbf1da6e0ef3e0f98265
SHA1 hash: 3a844aeb1671aa9d3fb6837d24d8024fd8504dc2
MD5 hash: bdddbe7e59d61b6d0f51b76aa577391f
humanhash: lithium-freddie-vegan-beer
File name:0dce0d2b02f772ea624ce7ac5dba6edb.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-04-01 09:15:15 UTC
Last seen:2020-04-06 14:30:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Lh9MG4uV/c69OYYUA0eucH9v9h7o2QGVYTlDb9oyTV:LDptMY5O9hc2QG+ToyTV
Threatray 10'528 similar samples on MalwareBazaar
TLSH C6542A7C2B88B902F73D593289D1667022F2D4934D12CB0F6EC51EEDBF527CA295A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1WTBlB1hjCH-zmAxcwDJAeMDZJKjeA3fk

Intelligence

File Origin
# of uploads :
5
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-01 09:35:35 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sqzhad2zxvtsckmutvzqykrddgwhk3565wbywb4q6saolmuxlzuq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
086c1521c7a0fbd3682735839bb71e477a3b58925fb20822b92971fba0cf8e05
AgentTesla
102cd8a7207ae8f27f844ffbb51eb18a95ba3f6647aa2b2d7031dd3000ff225c
AgentTesla
39436f7a65addc64e6d315ff21c45378e897fe5ec175b8d4e3879ba83a41ce6b
AgentTesla
6824c4afb5e56e0c2b3e0b89a4acde70bcc2bd792334a6600225e623162ae621
AgentTesla
765d4e32e33979b9ee122877162ddb3741a2cc7df514b96b637e28651399be70
AgentTesla
8a7fda03853530c6a6c414d95c01f3957d56878a600444a97da54ea70dffbc3c
AgentTesla
93067db4ef5e78e64594568bdbbacfe0e1f8d7cc354a0b5c4e58ce6b37903c05
AgentTesla
94fcc8c7fd53c5463c0d33d1f74b5c7c8c0ae95ef097477958acb9df1ae5a15e
AgentTesla
dda6fa100ac492f3b6b2bd5a619c0926b4a40431f8c0e0593d0bcdb2caf3d7b0
AgentTesla
edced06a3011186bdf81b8e16739f41cb226ce9fdd57e9d8d006da27874aea65
AgentTesla
+ 10'518 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

b6888ecaa7ff93206a85cf34cf5ad84c215eeea10036b4f2ad30fc864b63ba6d

AgentTesla

Executable exe 9432700f59bd672129949d730c2a2319ac756fbeed838b0790f480e5b2975e69

(this sample)

  
Dropped by
MD5 0dce0d2b02f772ea624ce7ac5dba6edb
  
Dropped by
MD5 812e69df3580644a52a10baa05361b3d
  
Dropped by
GuLoader
  
Dropped by
SHA256 b6888ecaa7ff93206a85cf34cf5ad84c215eeea10036b4f2ad30fc864b63ba6d
  
Dropped by
SHA256 f12db15c7bc540b5eba0652d3843d70117370bb39ade080a0446b4add8800a86
  
URLhaus
https://urlhaus.abuse.ch/url/333257/
  
URLhaus
https://urlhaus.abuse.ch/url/334017/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments