MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4cf16d4a0d4871fab22511f073c0cf293b9863a06d0fc733a9cb984c37c8886. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4cf16d4a0d4871fab22511f073c0cf293b9863a06d0fc733a9cb984c37c8886
SHA3-384 hash: f01dd67ae782fc74a42a4f7b1cf1ef90e324d2be6dc28916b9f7e96fce1c3f6e4bcce74f9b411dd89440b7eb519bbd09
SHA1 hash: 72e49a7457e082967642fa1da35b1a2ef01258a9
MD5 hash: 925bcef02f2985a23dad1ab498238bd4
humanhash: angel-alanine-south-colorado
File name:1f54331fd29b35d90c3034038c705f28.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-03-26 15:45:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:kEioLzi6+sgY6LlGKt8kMZ7Y+4lLJvVfG/2bYoCTV:fLzi6+1YegFsLtCoCTV
Threatray 10'423 similar samples on MalwareBazaar
TLSH 5954396D2B88B902F73D1D3289D166A112F294834D12CB4F6EC41FED7E5A7C93C4A396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://darco.pk/asus/New_product_encrypted_CF2AA4F.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:37:11 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4thrnvfa2sdr7kzckepqopam6kj3tbr2a3ipy4z2ts4yjq34rcda._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
1c52fdf3b0e990fcb41ea7b549f42b96be5d5ad6222f47384c2d1569c9469e1d
AgentTesla
24245c3e1af247d82a4afe11c35679ca51f6b815bfc17c4c79768ce8a2d7fef7
AgentTesla
abe3b715d6cdbdee68f7fa07dcc3adec8d247a7729af88c782d0282e9cf4d7ac
AgentTesla
b0cd91c32f6b9cca78cc162d1967e47de491d55b928a5e6538a104249d523f7e
AgentTesla
b72906cf963bcf4115a7d436a4768e76597524faf4a12f60fa42c2d59346b7bb
AgentTesla
bf5ea94f9caf0f0db89ebbab1b2d022be6381423eee08d35afd2e14b465ea840
AgentTesla
c8a2dc2d749fb852bf24d0829a88005eef37709eb07f68ed54370128f4a57f8a
AgentTesla
e0c77f3ea11cdd3c5dc2ba426be1b4bc962911d94c5cee891cbc47be8bf33f16
AgentTesla
e528b878e209ef5fca0d2fb3d92531c13aaaaa9af90fac69d3fd88ff2942cc0d
AgentTesla
e776b470d3fcb5868c8057d3c1dec30ac9ff0aba142915d163853938328a7176
AgentTesla
+ 10'413 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

cee6c236df8db5c8ec89cc5a43f9b35a9f38a18f6220ba8dbbf166653a5f8654

AgentTesla

Executable exe e4cf16d4a0d4871fab22511f073c0cf293b9863a06d0fc733a9cb984c37c8886

(this sample)

  
Dropped by
MD5 1f54331fd29b35d90c3034038c705f28
  
Dropped by
MD5 5604cf784c41f6fa40cd1e3c0731f6ee
  
Dropped by
GuLoader
  
Dropped by
SHA256 cee6c236df8db5c8ec89cc5a43f9b35a9f38a18f6220ba8dbbf166653a5f8654
  
Dropped by
SHA256 bd3eac50ea079d1515ffe7924af1a6476a2c051bc186354cec0b9c251e6c5d0a
  
URLhaus
https://urlhaus.abuse.ch/url/328842/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments