MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7f91e8b80d469bdd1ab452b999a839daff2bd5deb86d24d9a197e7a2941b604. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b7f91e8b80d469bdd1ab452b999a839daff2bd5deb86d24d9a197e7a2941b604
SHA3-384 hash: b9c9277d698364078304b222c437f31a74b8c80b896181f8a5d7ea9801189ee2a82e3c5884c7caf9d45a01d5fb48eb59
SHA1 hash: a37e4ac3e03aba009af204f36d75a2c583271570
MD5 hash: 7606f5145eeb8700be82ebea3e99f86e
humanhash: hawaii-arkansas-freddie-high
File name:11_binder.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'032 bytes
First seen:2020-03-27 12:45:47 UTC
Last seen:2020-03-27 15:51:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:TuESrK04h86g6xvKSVkHELcTSKSi6Iy5mSEywA81Krb3oGTf:TuES28CTkHELceFfPoGTf
Threatray 10'537 similar samples on MalwareBazaar
TLSH A254297D2B88BA02F73D4D328AD1266066F294834E12CB0F6EC55EFD7E527C92C49395
Reporter Racco42
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-03-10 13:52:01 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w74r5c4a2ru33unliuvztgudtwx7fpk55odnetm2df7hukkbwyca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2f3b7dd3632d2dc0037eab330830f33c2608b363049864db3af11f4fb29e9b9c
AgentTesla
36f23217058d61b401b63cfe41e8a7ccc1f5525a3f6b0c57800fda8403429fb6
AgentTesla
3a83183d7ddb15963616f33d030932f0f04b71c66cfbec7bd5d2296c2177f6e6
AgentTesla
3acbeccd335e0141468ef85211cabec3f8cafc0583e94a0e59624905e972616d
AgentTesla
54e459b9722f9aa133e87abe7a92a8f5500cda7ba967ea9340978cee66631032
AgentTesla
9a8948340515796c4fe204849492d03184034350e2e28c1e34beba51a9b960cc
AgentTesla
d019817ea685d2263a332bd4dd3b95ea750ce42f0834ea7c6464c2b7328b8ed8
AgentTesla
dedf36514df689bf45199f4637020acf6f800ccdca2f8558b96973ed6298b72b
AgentTesla
dfca8cf09994229afec678b5c279d247e3e69c45f2878f816025b4933f3bc3b0
AgentTesla
e93f94c0bb264f3323526dcdce4efcd7e74a95f8d5b2609463a5d27c4b1200cd
AgentTesla
+ 10'527 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments