MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9bb806aeef6d85e75074a7dc16d1773899a8fd9de9996c7307afdb4d7b60f30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9bb806aeef6d85e75074a7dc16d1773899a8fd9de9996c7307afdb4d7b60f30
SHA3-384 hash: cfa17967b718d388437abc60032ad72277e1d678098b9f06fe7d43b6efe3da159b45ff36cdca6f4c21f594ad053ee0c0
SHA1 hash: c886c597a26f85d8a7f8e5277303bd7c88fa8b59
MD5 hash: bf91ba3abaa8feb7313a3dd7079fb9ce
humanhash: chicken-mississippi-georgia-high
File name:24a7a310139dba7a522e4c0ea9b7ae2f.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'280 bytes
First seen:2020-03-26 15:23:18 UTC
Last seen:2020-03-26 21:56:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:dmMB0GglZx4C7iI+xPTry+ML7lgL0bvyL8G5ZhYhiF7aF2bm:ggOZd7izi+iA0WZ20
Threatray 10'401 similar samples on MalwareBazaar
TLSH 1254085CAB88B902E33D1D36C6DA926013B1D1834912C35F6EC44FFA7B577CA394D29A
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1MwoZftXVgvZAQcxkt1a7VyY9jxXM_oaw

Intelligence

File Origin
# of uploads :
4
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 15:36:26 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5g5ya2xo63mf45ihjj64c3ixooezvd6z32mznrzqpl63jv5wb4ya._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
2b115e42d37b2c740cf134413b64a79dd1486a08766d0d53a1fa70c9066163a3
AgentTesla
36af666d53cba0e9c1b3a2e4e6d9513581090d3fdea442cb13dab3aa2bdf6d72
AgentTesla
66dcc6879cbad6d6bd91f0599f73e7a04eaadf041f9416ade10a76d46102e4c4
AgentTesla
68f746d2933821737aafcf2bc00db8b8f2db8fe6b6aec4ea25eb0bf31b1c370b
AgentTesla
7f547a386bca141205b0b5ce1d37c2de284b25988c8dc693ded6e10232251626
AgentTesla
872e06d165968c0548d362d26c3c05ba9c3f35fe1066c5623dded0dd7cbb92f2
AgentTesla
8800fbb61281cd07571f34ae8c9b2eeef62179b7804e9a8496b264ff9173df61
AgentTesla
bc15b59bbfc3e94347809a2bb9f8fbcc1982b2ef982635d6bb1d9a7be1cafbf4
AgentTesla
d92dcda06015bc3d7dc48098eee32a8e77b6b387790abefbff55cad7ff44fca3
AgentTesla
e6f24dc63903a62c11b31f12fdf5e6c71d434782963b51e3e25a9267d4004949
AgentTesla
+ 10'391 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

1d522805cb5b9c24b336f7d189a8fff0a9560a66ba2d6e2f4a014ecc48767239

AgentTesla

Executable exe e9bb806aeef6d85e75074a7dc16d1773899a8fd9de9996c7307afdb4d7b60f30

(this sample)

  
Dropped by
MD5 24a7a310139dba7a522e4c0ea9b7ae2f
  
Dropped by
MD5 6183592d0e765a265a7408523837dbe2
  
Dropped by
GuLoader
  
Dropped by
SHA256 1d522805cb5b9c24b336f7d189a8fff0a9560a66ba2d6e2f4a014ecc48767239
  
Dropped by
SHA256 ba1f981418a46cf5c13fb410b2f20b74fe6c8147b8f5653c33989a55231082da
  
URLhaus
https://urlhaus.abuse.ch/url/328607/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments