MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5faf857326e895e7c9fb3da1c33c8fc0c68c0f045d5aaed1a55b2a75436a9cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5faf857326e895e7c9fb3da1c33c8fc0c68c0f045d5aaed1a55b2a75436a9cc
SHA3-384 hash: a09ccdd3f4a23d9a362816716ace8c54987f62042af01b5ee45dffc0a930d043d9f0ea1a5d03c2fa853ad9c24daba116
SHA1 hash: d79371a8fc1dee53aa0e24d42cf5a9373cd06260
MD5 hash: 4dcb05e80e03e137c8f62bfd9245cd2e
humanhash: eight-monkey-march-high
File name:c87174fdcf0ff709c4875d77d7f69450.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-06 02:25:18 UTC
Last seen:2020-04-08 17:13:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:Sd/kVeUbAyBIrdEUczAN8Q2PUEBTUoJqj5XvDx5TxbboyT7:6/kVsrsU2zqpBoyT7
Threatray 10'585 similar samples on MalwareBazaar
TLSH 3654297D2B88BA02F63D5D3289E1666012F195834E22CB0F6EC45FED7F577C9284A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://bondbuild.com.sg/wp-includes/pomo/MAINtracy_encrypted_55A3B50.bin

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 02:35:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
34 of 47 (72.34%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4x5pqvzsn2ev47e7wpnbym6i7qggrqhqixk2v3i2kwzkovbwvhga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0cb9e417f6d669eb497a3c451a30744cbe7b4bb5f7acb01d55956e1021303d2a
AgentTesla
246366b847f40185b79d4b7dccd159a0ea49b16043baa6c2898ad6dc88fcf0a0
AgentTesla
2a44717f99e2446d315027f4cd90bfca21e77fcba2811ec556b1193de98b7d38
AgentTesla
38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba
AgentTesla
4aeded46b92aeea959a9f7f8315dae9d9ddd3725cb6ff0a01df1820e11ebd2a2
AgentTesla
4faa4683bd7134b0823bd0f04f894136bab28fb33f6163f803d08b6dd80a36c2
AgentTesla
5a2965c63c2c74a0e8d06008ead3a82354dfd319468074823d5224a63e1a5c52
AgentTesla
733b9a08b05ec70c7ac0d28dd9b9e832c85e668342fffe880e0e2ab5222de082
AgentTesla
9473ba282d493f6b4e5eddcccddc1e998b3c2d215801cd94cb793b36d1c6b71b
AgentTesla
9ee4015e77250f861a3c3868a074de25eddfa3e6a2dbd159be7d61ee65513aa0
AgentTesla
+ 10'575 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

6c89c83f4bccba85a2bdd8a3defa223b64cc51a948d1913fc6aef23b8caca072

AgentTesla

Executable exe e5faf857326e895e7c9fb3da1c33c8fc0c68c0f045d5aaed1a55b2a75436a9cc

(this sample)

  
Dropped by
MD5 c87174fdcf0ff709c4875d77d7f69450
  
Dropped by
MD5 8fdfc76e08898aeb23001237c5ba3b8c
  
Dropped by
GuLoader
  
Dropped by
SHA256 6c89c83f4bccba85a2bdd8a3defa223b64cc51a948d1913fc6aef23b8caca072
  
Dropped by
SHA256 dce27d7259676dfd86a33a866fea8ca22d16ffa48ae501b54e872b5e01e7b4a8
  
URLhaus
https://urlhaus.abuse.ch/url/335707/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments