🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610
SHA3-384 hash: 4da6ad76ea1549b5a9d3d4f6b7bb448843838c776186e2c1e8a5626c27839f116e4f598b98456a1bdc82d08691221d5e
SHA1 hash: 1f6c9767c87c8031deafd5820639a6d356275226
MD5 hash: 69566a0ab5c951d1372a979d75492258
humanhash: queen-single-jig-lion
File name:ed0b11fc8bff7faa9237364dc4137191.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'472 bytes
First seen:2020-03-26 16:53:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'688 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 6144:Es7qFA+FC+M2ym1O00WwSHH32+iaEsnyNRFVWO9GxvbRoyTV:X7t+l/1H0iHlrnyWfoyTV
Threatray 10'515 similar samples on MalwareBazaar
TLSH FC542A6C2B88B902F73D5D3289D5266012F1D5834D22CB0F6ED81FED7F567CA294A386
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1YrROazSFavf09uQQimYNbQnvHEVRMXz-

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 17:35:32 UTC
File Type:
PE (.Net Exe)
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ci55esrl2jdlr7t65rbsa4urfjj2z5z3bwyv5o4ywclc2s2u4yia._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
09b0e2a84a8e7165c5a3b23efcd53cde0a7090e1ebe09a86cca86c33f7c39290
AgentTesla
2836e2f050c5ed948fb0652dde8eca6e867cb25aaa835d8b58738ec251dded5b
AgentTesla
3b579b5c48b467cb0e3a3b28773a63ce90b11a87f4baba15b98d0af36291a314
AgentTesla
3e49a3d5e53c479d5da50528b7d62df675d22baa97198cc1ba50ea0f40bdd2e7
AgentTesla
8f8f28f5eee0d7e5a4bf151528beb476347dd84c94ef721675237f00e391c6f5
AgentTesla
ba3bac695a448759f82d4c5180cad7d308fdb8bc12a159456b75ead72aca9424
AgentTesla
d63ec5231d1d805fcf8272f20282fa1bd9b94cc01c309a5eaaf32c1e09f9df6c
AgentTesla
df4a4e6430488397eecf551b6f8558f71d5bc65fe78d70cde3d45e38e82d82f9
AgentTesla
df981c11b8789dcff16652bae782bd8f5112ccbe7377d3f5088be62e2469b214
AgentTesla
e200737a203c4aa2f0dd82a3fc5fef097eb0e64b81b231b29b3022741ade5976
AgentTesla
+ 10'505 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

c98f3359720c40b0df5c6235f5368ca3a3168dbf5a7ebd2d7d319d3b4e441ed1

AgentTesla

Executable exe 123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610

(this sample)

  
Dropped by
MD5 ed0b11fc8bff7faa9237364dc4137191
  
Dropped by
MD5 55ea01715bc198cd87f962e38fdd665a
  
Dropped by
GuLoader
  
Dropped by
SHA256 c98f3359720c40b0df5c6235f5368ca3a3168dbf5a7ebd2d7d319d3b4e441ed1
  
Dropped by
SHA256 4f58dfd0523d94ba8c9c32cfe09c88c7088e75d523e6d6147331f8bfa70a4705
  
URLhaus
https://urlhaus.abuse.ch/url/329165/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments