MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9473ba282d493f6b4e5eddcccddc1e998b3c2d215801cd94cb793b36d1c6b71b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9473ba282d493f6b4e5eddcccddc1e998b3c2d215801cd94cb793b36d1c6b71b
SHA3-384 hash: 4908c99612bda0ec39d60742509d9cf82af68e69b8663545c819063cfed891de5314d94f33e5d3d7a86e1ae29c7ae8b7
SHA1 hash: dab02a9c176bcb6fd88ddde79f73a2afec0dccb0
MD5 hash: 2813f2919eb6f9e9b6dd608fec8a086b
humanhash: finch-nebraska-robin-alpha
File name:6df9da0a58f31370e2374a9c84dffc50.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-04-07 12:09:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:BSlSXn+lNTqqLMAMBBEnrvT+x2MaihxEfXYTnhbLoCTV:+SXn+lNTBbMMPMFoCTV
Threatray 10'749 similar samples on MalwareBazaar
TLSH 5E54297C6B88B902F73D5D3249D5666022F191834D12CB1F6EC81BECBF577CA290A396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1NlqxkHyuOSDz7TYPc2SOuq9V2udpDFQd

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-07 12:36:00 UTC
File Type:
PE (.Net Exe)
AV detection:
32 of 47 (68.09%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=srz3ukbnje7wwts63xgm3xa6tgftyljblaa43fglpe5tnuogw4nq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
28d35f312f960967d6d5a5339fa1d2f810842d38ceed7fa2f866b1cce5e1120e
AgentTesla
62641f232fa15a7a92eea090fa3a78dce5b369d09cbfd3f4629b693b03eb9021
AgentTesla
6e1b968192bdf51820df2d4c83f322000331ecbf6a1f5e6c91301d2bfdf47637
AgentTesla
706c201e12bde06af9252749e2c7959fc53fcda81ae5d68702238de5a004a639
AgentTesla
8b54382eba3263ce82d5c895230a9b1dc922b245583400c62f425b0b25119679
AgentTesla
94d56969da9a37c91e90d7b322040320285103ede8735bcca0773a1e8fd7b90a
AgentTesla
9c05da35b9f24c43aebafbffe27c556ec9310bc6caa520af20b1ed0edf2198b4
AgentTesla
a2e17761869255e493552394591dab6b9fac60b3577ec692ec47a7967238a462
AgentTesla
e5faf857326e895e7c9fb3da1c33c8fc0c68c0f045d5aaed1a55b2a75436a9cc
AgentTesla
ecb77b0aafd61f01b0f6c843594fbccba38abc0fa1df4209d9a19296567f0e94
AgentTesla
+ 10'739 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

18dc7aa490c068bc56d9ac91185537efe0268f9e6b89e1fd20b0a7e38f2c80ed

AgentTesla

Executable exe 9473ba282d493f6b4e5eddcccddc1e998b3c2d215801cd94cb793b36d1c6b71b

(this sample)

  
Dropped by
MD5 6df9da0a58f31370e2374a9c84dffc50
  
Dropped by
MD5 3ca9b47a8c4b84ea96473abea0e3ae83
  
Dropped by
GuLoader
  
Dropped by
SHA256 18dc7aa490c068bc56d9ac91185537efe0268f9e6b89e1fd20b0a7e38f2c80ed
  
Dropped by
SHA256 a792724e9a93068ad59aac5f5bf58d0c6124c56597ac1a2a0c3ef3b7a35760b8
  
URLhaus
https://urlhaus.abuse.ch/url/336173/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments