MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb18282566acfa61046f56dd07ef72397528a06b8765c6b033d5153bf9bee0eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb18282566acfa61046f56dd07ef72397528a06b8765c6b033d5153bf9bee0eb
SHA3-384 hash: 28eb2f409ce1aa1b6d9f9789de882ca3e404dd18660b63a1a058f5f9b1387862a08ffdf98da1c902d6be1b5652b9cfc2
SHA1 hash: 65a0f65416cb158bd3b5288029f4c188cf0b16b6
MD5 hash: 9a649184c1aa5658c77fe7bd80b689c8
humanhash: pip-fifteen-alanine-mars
File name:c000060fd682a48d1922878d06acfaa8.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:287'232 bytes
First seen:2020-03-26 15:22:01 UTC
Last seen:2020-04-05 22:00:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:EfMZPFUbkmMTuqtg8/3UaPJGlCCYdgz1ywThbWOW7KJbz:Ef6+gmMTu1OBPlgNt
Threatray 10'430 similar samples on MalwareBazaar
TLSH B5541A9CAB48B901F33D1D37C2E5A26093B190835912C34F6EC54EFA6F533C9794D2AA
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1UI-eoCFOeadBU8isyhcl_zeYK6lxX8Ir

Intelligence

File Origin
# of uploads :
5
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 15:36:27 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mmcqjlgvt5gcbdpk3oqp33shf2sridlq5s4nmbt2uktx6n64dvq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
06face53825c51be55c3ad20e23c5d4c4f8714208c7edbc96ec3b3999665df46
AgentTesla
2b592308b29b6758a2ccfc2728f755be9f93e80e6712e39f0f95487723f808f2
AgentTesla
4667578c74184250d5ea1ee15fa4f23e8e36ec0f34941c3695b939002ca3c7c2
AgentTesla
47f6cacd998a57442a950d19453874b725e689ae02ce9869cdec782595eab377
AgentTesla
559319bcc870056c88c3e180aab8acf899786bc2c923ebf49e73195339c6f25d
AgentTesla
75baae23f80f6def274e340b17867d205068b34425fe6f7537c9667e370dec5a
AgentTesla
b3d8eff8aae92a5b55b1b1b8b11f1722f3065d4e0d2d0d8f248942e53d139d37
AgentTesla
dff1e27ea5797b49da2a5c7ca8ef6af4b4681d9bdc3baf92ceb0db77cb00fc83
AgentTesla
e2d6119bb484c9e5f5a7107b4687553416208badbb881df4328bec5146d08509
AgentTesla
e8fc1d1eb0d1c410871c40d42a0090f5123af39ab7f71176bda694db65bd48f4
AgentTesla
+ 10'420 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

d9200d2c30f501f8ca006d0f04405491aec8f163358f03422505d96fafdeba92

AgentTesla

Executable exe eb18282566acfa61046f56dd07ef72397528a06b8765c6b033d5153bf9bee0eb

(this sample)

  
Dropped by
MD5 c000060fd682a48d1922878d06acfaa8
  
Dropped by
MD5 24d53efb8be84f030f73a0a5c933572f
  
Dropped by
GuLoader
  
Dropped by
SHA256 d9200d2c30f501f8ca006d0f04405491aec8f163358f03422505d96fafdeba92
  
Dropped by
SHA256 0b20636f1e54d7ddb3ffae010c1dfa0ffacbe0a608ba36739fea4bc6436d1001
  
URLhaus
https://urlhaus.abuse.ch/url/326917/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments