MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7052536e8f3b3224cdc9edc70a1a7f3a26ad0fc9c620c80eb91f9168ce81ad0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7052536e8f3b3224cdc9edc70a1a7f3a26ad0fc9c620c80eb91f9168ce81ad0c
SHA3-384 hash: 90137ad300cdcdd9313d491c37162e110017ebdb0900f0a046aa490b53dfe10d37c7db493c2775b70d1d837a4ad63f2b
SHA1 hash: 8fccaabd1f0a48b0e79e0e1299750adeb9d8e0c3
MD5 hash: 57381d7f4b43103c4883c1ec65fb3a13
humanhash: rugby-lithium-july-pluto
File name:SecuriteInfo.com.Trojan.PWS.Stealer.19347.6393.17559
Download: download sample
Signature AgentTesla
Create hunting rule
File size:823'296 bytes
First seen:2020-04-24 17:41:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1fc46905838e9cb2fdda61e407b72c37 (1 x AgentTesla)
ssdeep 12288:mi270IwuX8RHA29NDgqF+eo1RNTZML3alc43zR:mi270puX8DnGeoTNG3altDR
Threatray 9'077 similar samples on MalwareBazaar
TLSH 21051210924BFC11E65603B799C2E514C28E9DB824C31B66F74DFEDD7A323A83292779
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Ponystealer-7705419-0
Create hunting rule

Win.Trojan.AgentTesla-7705465-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2019-11-16 07:22:00 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=objfg3uphmzcjtoj5xdqugt7hitk2d6jyyqmqdvzd6iwrtubvuga._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
284f5d7c77eab431e6dd8bdd9e508bbd1e2e3dc467b40f68b834b1a437061061
AgentTesla
349c6730ddc5b8a6969dadbda237829f6cf52f57101ecb03adbb4024df5da299
AgentTesla
46ea1705549840fd45e067930511c81a0b8979698f98e4b170b9a93b27a6ed0a
AgentTesla
647fee1c3bc734439133bd78fe6519ad349501ac7a83e179601950f97fe96e1f
AgentTesla
790fc0569800e0cf91c3b7bbd8517a2f5333960fdfa5714719c6e1e57d85f826
AgentTesla
8a99dac3ae2da7639b0544b3f0b40f4b76ecaacd5c7c089da603bdaed39d14a9
AgentTesla
8ec3dfa660419f2ae1ad9bf98d0281f3c24dbf0b5ea22f6b1fcac34d94c1998a
AgentTesla
a0a84ef378c8199a1b4511396d185b39d2dca86ffc608144f9d12f61d7d48cfd
AgentTesla
a30738760b8787a51d134470d53a01d3a970869a03e143514fdfa68ab6436fe6
AgentTesla
a9e51c077a3cb18a4fbb72e9a01bdbbeac7f78da7eb0462a6c191f5956ae83a1
AgentTesla
+ 9'067 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_blackremote_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 7052536e8f3b3224cdc9edc70a1a7f3a26ad0fc9c620c80eb91f9168ce81ad0c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/350612/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments