MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87ff4257e145cb109c3a91260b9412e0bf13ab481ee0d2e592254f8dd77db458. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87ff4257e145cb109c3a91260b9412e0bf13ab481ee0d2e592254f8dd77db458
SHA3-384 hash: 2b0d2bf18297aa1c1222d81e9e166aa034da1283c6c0d681eff41fe7bfb85220db6ef6a47d86ded0bad1700e7ffff954
SHA1 hash: a4bc0c8463d222a9b4447ebf319caf522a19fa58
MD5 hash: 6bbaf6df0f34a0ca7b761caabd4d4461
humanhash: batman-london-massachusetts-diet
File name:SecuriteInfo.com.BackDoor.SpyBotNET.10.24975.1110
Download: download sample
Signature AgentTesla
Create hunting rule
File size:166'400 bytes
First seen:2020-04-30 16:05:12 UTC
Last seen:2020-04-30 16:38:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:lmoMwrN7brGJqoD2L1EdLXNEoVbrvu5RdicSlbe33A:lNtrNnrGJqoDT5XNBVbrvudixC
Threatray 66 similar samples on MalwareBazaar
TLSH 57F3181063EC4706D3BE4A79E472522842F3F34A6232DBAE4E5C64DD2F23B50A5517BB
Reporter SecuriteInfoCom
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.10.24975.1110.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2020-04-28 23:37:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 30 (76.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q77uev7bixfrbhb2setaxfas4c7rhk2id3qnfzmsevhy3v35wrma._file
Verdict:
unknown
Similar samples:
4aebd2918942c4d01076cd9cb47402c5b8c61e14e86a397488d1abc2e444d626
AgentTesla
555f84812f700d1448fd200f04200ae9d17413652be94c54ba442fccdf9104dc
AgentTesla
642ecc0813761138cff276fdece24e479604dbc7c012a2a168d018330e1905e5
AgentTesla
701e2cddd4d1628c01c3ce13a20b5414726995565377e6ddc3133d1245a88cb4
AgentTesla
7310d9b87d90bb647879dd9a7adc8cb76e0630dca1e15e75abfd0083203e83a2
AgentTesla
aa0ef170fbdf28b626cafc71c401ce5e5b151efca751e1301ab1d68ddc6af5ad
AgentTesla
c4a2c8397cfa4f7f16a317aad541b6c48e35c4420249f702b2c6f01faf66ef61
AgentTesla
c4e42ebfd487b325ece4f09d75687c96e252aa8559f8a8daad6336dc39ee5424
AgentTesla
d1eb54cb3aa9ba1fc585cf676c4a814b11786b962da1b1959768794d281084ab
AgentTesla
e12bf1c4b6712d15cebf8556b8d659bc928c6ac18efbb081d56811bd48ce3359
AgentTesla
+ 56 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AgentTesla

Executable exe 87ff4257e145cb109c3a91260b9412e0bf13ab481ee0d2e592254f8dd77db458

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/354743/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments