MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5711701ae7987db61ac9844498a2362e731c82865b9bc2dbacfcf2ad36e5a1ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5711701ae7987db61ac9844498a2362e731c82865b9bc2dbacfcf2ad36e5a1ef
SHA3-384 hash: 0b3f0f251ce7c360ea909eba5557d79339b2dca6a42e0eb0d97fec780b22d9683f4d5cd68b01382c55bfd6296ad7f03e
SHA1 hash: ca095b65d250524f04debb71b1add9f59cdea5d4
MD5 hash: 104e8e30c305013748866c6f69446a9f
humanhash: neptune-delaware-potato-montana
File name:eze.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'520 bytes
First seen:2020-04-06 13:58:31 UTC
Last seen:2020-04-06 17:32:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:gbXGuOz09D5xoZo27RLhCjhu8SoI++uZebcyO8:gbUwmRgtyO8
Threatray 10'513 similar samples on MalwareBazaar
TLSH EF542AAD2B98B902F23D593745D1222592F2D0839E12C34F6EC44FFC7F617DA2A493A5
Reporter James_inthe_box
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-05 23:25:57 UTC
File Type:
PE (.Net Exe)
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4ixagxhtb63mgwjqrcjrirwfzzrzauglon4fw5m7tzk2nxfuhxq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0107fadc185fd6b53dc033d4a79e53ef1621ae623917de029b6c02eeae2021c1
AgentTesla
40e9b18a9ae56099292d10bd537b24db851b03b38a54028f5460b1433f4aa627
AgentTesla
47dc93d9f50e610072c38ed05d454b31b9a4d9c31f2abc75840dea36ec4ef374
AgentTesla
6407a885f99633b2f5559e9f04b001a859367468dd7e761fb28d527995f3112d
AgentTesla
7dd1ac7e7f7f3a85ebdcf6337b4f83dee2e6421ee4373e6328c08d8a0854ae9a
AgentTesla
9f012db0c8342a6f28a5ba72eca98c615574e3ca6e34be8b84d54a9ebd7d4d68
AgentTesla
ccbd1c75dcdc38d5e34a96583e808c960836e85d76e87de04c13ea420d380286
AgentTesla
dcbfc03cfe9523c25ab335f599cebcbbe8f2439ef7ab973aa9ec0330e4e7d11f
AgentTesla
ea2e7ec387cf91e0ad3d44c01b25adc702061e93b66d21f8b3dd1eab812045f9
AgentTesla
f3141eb0d06d4ddce695865bbd38b6d1c9fa564d3ab4a9f1a5d1c0bb9c9931cc
AgentTesla
+ 10'503 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/335769/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments