MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fec96084e8e028b9b6525701714dd4e0fbc689b84b62b451039364a6d4437471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fec96084e8e028b9b6525701714dd4e0fbc689b84b62b451039364a6d4437471
SHA3-384 hash: 6ac2c0ceda9006a5ca5f9d52a27ef34ca15ea1fcfbe6d0276bdc25b67171dfab348b944fe6987cec8694417d39ca9278
SHA1 hash: b0ea228c4eaf39d40e34f9475be538c915044072
MD5 hash: 34265a94095dca0ec260ab0900777b8a
humanhash: florida-robert-saturn-saturn
File name:1977a17d77ba036d3d93e15b637613b0.decoded
Download: download sample
Signature AgentTesla
Create hunting rule
File size:294'400 bytes
First seen:2020-03-26 13:47:05 UTC
Last seen:2020-04-06 11:50:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:3IEE+8/EVCN92KbETWSd1a6rFcOhqmAaAJ3Be2bWmSTV:iFLC1G6ra35aDmSTV
Threatray 10'462 similar samples on MalwareBazaar
TLSH 9A543ABD2F88B902F73D1D3689D1266022F195834D12CB5F6EC85BED7F527CA284A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=13E7Kr_YMYK26Cbf_RuPgWu7t-GA7id8e

Intelligence

File Origin
# of uploads :
3
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 14:35:49 UTC
AV detection:
27 of 45 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73ewbbhi4aultnssk4axctou4d54ncnyjnrliuidsnsknvcdoryq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0adddcc2c03723a2282bbec5342b52f6b765973774593125a9b87939e3f8a8c2
AgentTesla
123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610
AgentTesla
1300fb6c79d34c9e16d2b31ea26080cccddd855981c80ea0472145bba105960b
AgentTesla
1ea72043598a1a8eea973a2bdc0f20c2291c1b5da34b04c3a7bc32d6b70e7863
AgentTesla
2eee2228cbdbc9a9b17ec67991a35ea92a47fa458653bcd9463c750c992f1f6d
AgentTesla
2f2a4a900557ab71b03b6c026acaeb9f0e2d23f681c5d0ea58a9b0c493721312
AgentTesla
3e49a3d5e53c479d5da50528b7d62df675d22baa97198cc1ba50ea0f40bdd2e7
AgentTesla
40c1619d8d1d3c493a6595e637366c5a01338b7e43df80cc3a742e0671a64ac2
AgentTesla
8756c4f14d4d8cb6449ced8a65ffd2cdf3aac1bfdc4c1c6838fbdbcf1f9e11fd
AgentTesla
bf5ea94f9caf0f0db89ebbab1b2d022be6381423eee08d35afd2e14b465ea840
AgentTesla
+ 10'452 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

be522a33a7612367d212977c2767a777c796f78ecfbf952241402ea23ffdd199

AgentTesla

Executable exe fec96084e8e028b9b6525701714dd4e0fbc689b84b62b451039364a6d4437471

(this sample)

  
Dropped by
MD5 1977a17d77ba036d3d93e15b637613b0
  
Dropped by
MD5 898885b428a03b7480e98c68582e328f
  
Dropped by
GuLoader
  
Dropped by
SHA256 be522a33a7612367d212977c2767a777c796f78ecfbf952241402ea23ffdd199
  
Dropped by
SHA256 9588800c17064ed7ca05761b49630893d45986d403ab14de71b771fc1f6efba2
  
URLhaus
https://urlhaus.abuse.ch/url/330465/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments