MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d65bfe18f4d7056bf6bc2dd0a41b8a1cc216ce75a03ee7df800bf413c6dcc36e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d65bfe18f4d7056bf6bc2dd0a41b8a1cc216ce75a03ee7df800bf413c6dcc36e
SHA3-384 hash: 55f46fc7d82cad128f86f3204f98f4384184ce5a128cc72bdecdcd991036ab340de99ab7ad31ceda6d04f7d4676c8e2a
SHA1 hash: 8a8f193e65c8b1f19739dbb97fb3ddf6f0d87168
MD5 hash: 724949cdb9fa4f8c25e0b2e7e86e39c3
humanhash: chicken-north-sixteen-tennessee
File name:f37f9a044080588e36dcb1233e6698cc.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'280 bytes
First seen:2020-03-26 15:23:45 UTC
Last seen:2020-03-31 23:20:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:nNWrp2tPzhHHB6d848FpPEhjcoLOPwyIibL:cp2teOpAcoLO
Threatray 10'595 similar samples on MalwareBazaar
TLSH 7454199CAB48B902F33D1936C1DA926057B1D1835912C34F6EC44EFE7B537CA394E29A
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1qPRo85Ka2iZOUZgBADDu7vsmQUxiVBvD

Intelligence

File Origin
# of uploads :
4
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Spyware.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 15:36:26 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2zn74ghu24cwx5v4fxikig4kdtbbnttvua7opx4abp2bhrw4ynxa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1f5501175aa21ba313350d75cf0c5346095ea7df5b8a4f258bba1b95af6b5a1b
AgentTesla
30fd049e01b512df68d84c6f5a92a705d27ad52327f8e319a760aefec037f792
AgentTesla
3e9e2439de98bb0cd68b88a219adadce76d2c23939f712632ba47edab6e46e3b
AgentTesla
421d40b21d1618f9d998f32558b256058f93f6de3d505e6590bd649ab6f1c496
AgentTesla
71c072bd6aee1d2dc994844b21898236a143bdfe21e4c282d00069d0b63f05ba
AgentTesla
7248d0601627171f4663a14d2e7ca4d80dc8060cd8e126ff18b53d9139b5e423
AgentTesla
b1603b913f811ff40a9365527d9900b7dd099ccc27fc596f2ed7a2027a640851
AgentTesla
b9f01aeeefff60dcc8f6a40f77b5d30a89e4a3e48a9b072b5177b80a9e6471f4
AgentTesla
c82bb0bde10df742e0ec073ca489ecd1c8b0bf250728a7345b4577ca15f54a3e
AgentTesla
e7c32ca85ac18ca98fd62854a59f4751868efa0d1d40d4757b1388899a0c7eae
AgentTesla
+ 10'585 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

60a3846ff3a7c098ec8faf9714d4416e235928cd56e4c95c99e230030b10e24a

AgentTesla

Executable exe d65bfe18f4d7056bf6bc2dd0a41b8a1cc216ce75a03ee7df800bf413c6dcc36e

(this sample)

  
Dropped by
MD5 f37f9a044080588e36dcb1233e6698cc
  
Dropped by
MD5 481f54db741dbe76c0f9bffcaa9c509e
  
Dropped by
GuLoader
  
Dropped by
SHA256 60a3846ff3a7c098ec8faf9714d4416e235928cd56e4c95c99e230030b10e24a
  
Dropped by
SHA256 c4d311e56face1c511c4ca4d1f1afeabb6f4109b4a1fa9d517ebec8bedf0fb42
  
URLhaus
https://urlhaus.abuse.ch/url/328606/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments