🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83c6d11ba6f96505846001aa195d3daced4d9c8fd2058fc8a68a049dbd6066ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83c6d11ba6f96505846001aa195d3daced4d9c8fd2058fc8a68a049dbd6066ea
SHA3-384 hash: d612728e15eaddb34c9ff079886393869ab5519f4647ae52318dd43befa855f62027cc7116af3eceff9663723e2ad870
SHA1 hash: 70d7906e5d71ba8c1ce400f27f7fddf2fc4ad955
MD5 hash: 2418169f84cf9ece237059ebb246a32a
humanhash: pizza-nevada-cat-two
File name:e2e3991ad1d57b1e46304dd6270b37dd.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-04-06 11:25:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'291 x AgentTesla, 20'706 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 6144:As/afShrYQ/vbgHcsRL3rEf8UqPfrrSp3DLFhtlVOgI++U4btyOE:As1rTj/a4q3rrshtlVOxyOE
Threatray 10'611 similar samples on MalwareBazaar
TLSH E5543BBD2B98BA02F23D5D3245E1122513F2D1839D12C34F6EC44FEC7E697DA2A49396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=17K47Zq0yf9f3YvbdvtWQ5VTJe-3K71hj

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-06 11:36:21 UTC
File Type:
PE (.Net Exe)
AV detection:
30 of 46 (65.22%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpdncg5g7fsqlbdaagvbsxj5vtwu3hep2icy7sfgricj3plam3va._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
077ea1beb3d55288fae709ca1656bf8ddb08fca31dd675ac81de3980b7b3eaed
AgentTesla
312de3802dada78c710b868a26d744dc65991de475bc741c21c5714a84977813
AgentTesla
3168dedd367a1c486a5e5f79304a204e1508fcde7ea4fa2363e943a62330268f
AgentTesla
4717695c89cf6073f6fb151303d347d706a194db743857cc09a2074d2437889f
AgentTesla
4e0b4d0f9eb54314d659f34847e8f422b1e6c41ce5ffb11ae1b3ae0f0c44ac96
AgentTesla
56ab1237a3aed66ebe3a7464794c1bf41c40596456f92926f6d49e482922ebd1
AgentTesla
6519dfe26997fc43ff02521a72567a3477dfcee8dbdfeaf35253b30cb07d12af
AgentTesla
b8d0aaaac4f35677e4817853585a51dbdcd93cd1a35081e24557107584f318a9
AgentTesla
ea2e7ec387cf91e0ad3d44c01b25adc702061e93b66d21f8b3dd1eab812045f9
AgentTesla
f7216d025821af6be807018f12db7c5a5bd3cd21ef0176b02c6cbe0f05ac4cf7
AgentTesla
+ 10'601 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

cc6dceaff2a59ba2fa31ef3ef4510025344d6c7f9a630cbd06f4c056afc58327

AgentTesla

Executable exe 83c6d11ba6f96505846001aa195d3daced4d9c8fd2058fc8a68a049dbd6066ea

(this sample)

  
Dropped by
MD5 e2e3991ad1d57b1e46304dd6270b37dd
  
Dropped by
MD5 3b5fbb09eb6c6f385b4351894091da89
  
Dropped by
GuLoader
  
Dropped by
SHA256 cc6dceaff2a59ba2fa31ef3ef4510025344d6c7f9a630cbd06f4c056afc58327
  
Dropped by
SHA256 9884c884eec6965f16ddd01b6258af7016d6af2e3d0943517a6d1f57783dfa79
  
URLhaus
https://urlhaus.abuse.ch/url/335900/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments