MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e4c61028e569af183b697a0097f4668d1234478778b52a4b791da02b42096a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e4c61028e569af183b697a0097f4668d1234478778b52a4b791da02b42096a5
SHA3-384 hash: 81cfdfed1849981f3041226201f08abef72ab75da0edf995c78fb981767a01a6cb4f0812ffc56183f37dc68e5d45f026
SHA1 hash: a2f9e68cf74be6f773b2390cf60d860d7ef747cc
MD5 hash: 28e573c0eaa64bdde7c716a4cf0a2c47
humanhash: montana-harry-shade-happy
File name:iec56w4ibovnb4wc.onion_Library__StealersAndTrojans__Azorult__AzorultPasswordStealer.bin.malw
Download: download sample
Signature AgentTesla
Create hunting rule
File size:207'360 bytes
First seen:2020-03-18 22:53:39 UTC
Last seen:2020-03-18 23:03:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:FgbK1TaUEkVkH+LGP34oAmdv1xBKmvbeeGjuNaHy2glsalX2qqvJblYeW:2u12Uxdmdvxvb5GiDlL2
Threatray 7 similar samples on MalwareBazaar
TLSH 281409183BD54809E5BF8B3585A4716656B9E1632503FB0D0AF388DA4F237C1CD9BCBA
Reporter ov3rflow1
Tags:AgentTesla malw

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Razy-6519812-0
Create hunting rule

Win.Malware.Barys-6820546-0
Create hunting rule

Win.Malware.AgentTesla-6952874-1
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agenttesla
Create hunting rule
Status:
Malicious
First seen:
2018-10-10 19:42:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
27 of 29 (93.10%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0ae13a39ba870f8b572d742a201f342a022e9a541eea06143996839edd8a8906
AgentTesla
328fb34c41600c998c19272b039bb87b2db77bf9407eb002feb14ecf1eb0c41b
AgentTesla
610ab1c6d1d8f59195b85cc6bfb496adb9e6ce8d2f4e6764b84eae8bb5ae2cc9
AgentTesla
7c207a6ad28507e302b1165849b57a09695482d5c07bae27dcbba92a55163e5f
AgentTesla
a6bf564665f281e7226d137f8da8692436c44edb6ab7881cab31282ffd6649ad
AgentTesla
e3afb8be8f04e148a4214c375eff4817f2afcfcaff0f6a0bf2f5e324d9649b1b
AgentTesla
e9a8bf4f31da146761af10a16f17c402c2de1bfbafe5f770b1ffadbe373a2aa4
AgentTesla
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e4c61028e569af183b697a0097f4668d1234478778b52a4b791da02b42096a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments