MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efad28e77822049d1d0c699c9b8531df0d053f57a332b7f7b1618e82e9f7484e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efad28e77822049d1d0c699c9b8531df0d053f57a332b7f7b1618e82e9f7484e
SHA3-384 hash: 53bad3237b75cf68d0c79f1ef7474ba9559d325a173de4301d2fa2e9ce8f09db1cb23a37e2371df2173411dc19ac192c
SHA1 hash: 8f4411fc3d630cd06fdcf4e045c53e56e8d0c709
MD5 hash: 618055ffabbbdb2d2302a7c1daa43e41
humanhash: foxtrot-berlin-pluto-shade
File name:4a075f7efac3588f29a37555fa322ca0.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-03-26 15:37:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:uCyapHcSqKa66YmiyQAAzZItFh4vER9WtnfGS+9bCoOTl:uC/qW6YROptYQ9WtjoOTl
Threatray 10'534 similar samples on MalwareBazaar
TLSH 9A543BBD2B88B902F73D5E3289D1266412F194834D12CB1F6EC91FED7F567CA284A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1xNVuRceRNat-cNvgo1fCJjLnhpedp_Ys

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 16:37:12 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=56wsrz3yeicj2himngojxbjr34gqkp2xumzlp55rmghif2pxjbha._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0068cd1c85fc05f425fc6213b8317b2827528285d1a73b7df6135123161448ee
AgentTesla
1c52fdf3b0e990fcb41ea7b549f42b96be5d5ad6222f47384c2d1569c9469e1d
AgentTesla
20a94eccb531b9e7db7c2f15b4b02661781688b26407d8cad53ed9c3e1b16f88
AgentTesla
c2916832bcfec5ab78ce54df726a01123f8ecea355b8832cf37daf281d66f524
AgentTesla
e0d1c1f7fd8a8d07882ceeb4d681f9ff2b36912e9b0a8b182b3252599c2ea699
AgentTesla
e2d6119bb484c9e5f5a7107b4687553416208badbb881df4328bec5146d08509
AgentTesla
e33fd03e66a31d3725c9028e7ccf5c9118dbdecef0966df6610da20cda1abf19
AgentTesla
ef0e3fa0b391bdc3f8a6314ba3ca48cda4cea5a8e8e75f81681d70eaf4f3e39b
AgentTesla
f70a7863f6cd67cc6387e5de395141ea54b3a5b074a1a02f915ff60e344e7e10
AgentTesla
ff4ce18a829161a6d3e62fdcc8ae87d234b8b964abf8e7cddb9f44e761ae4a7d
AgentTesla
+ 10'524 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

096bfb02cff9dbf024a10f33127d4ad92fd7c2eb04836b58ff6f734d65541bff

AgentTesla

Executable exe efad28e77822049d1d0c699c9b8531df0d053f57a332b7f7b1618e82e9f7484e

(this sample)

  
Dropped by
MD5 4a075f7efac3588f29a37555fa322ca0
  
Dropped by
MD5 1f2ba311f41c31da86c04cbf9f065dcb
  
Dropped by
GuLoader
  
Dropped by
SHA256 096bfb02cff9dbf024a10f33127d4ad92fd7c2eb04836b58ff6f734d65541bff
  
Dropped by
SHA256 733f1ad1fb42327ed694ac165e9ae512d2b1fb5dc37870b62afd7e2faec72ef4
  
URLhaus
https://urlhaus.abuse.ch/url/328878/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments