MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ec3dfa660419f2ae1ad9bf98d0281f3c24dbf0b5ea22f6b1fcac34d94c1998a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ec3dfa660419f2ae1ad9bf98d0281f3c24dbf0b5ea22f6b1fcac34d94c1998a
SHA3-384 hash: 8ad0000dc1b2bcf271b3f48438a55ed345da81c8bb8afb078cf6aa1c0ed535bea6e9fde2bc4bf539df513ad512f97178
SHA1 hash: f26eadb2d24b3ca59edcc12c0d78984901d806a3
MD5 hash: b045f274c465de582ee8cf48b5dac65f
humanhash: nuts-stairway-march-butter
File name:INV#_07.2019.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:880'640 bytes
First seen:2020-04-30 07:31:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b814850fccc72caf588457e4f8a85c32 (1 x AgentTesla)
ssdeep 12288:Yj1BQOooQR8BVVVyu65Ou4w9eKjnnvBROo1Rvvg2Qzxvg2:a1qO9Y8BVVVN65bIInnvBRh7tQzn
Threatray 9'638 similar samples on MalwareBazaar
TLSH 9315D052FB1AF816DA461075675187AC3BD4F8370728404BF9E5A60EBAF4F1AAF30607
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Vbkryjetor-7130382-0
Create hunting rule

Win.Packed.Vbkryjetor-7130431-0
Create hunting rule

Win.Trojan.Gamarue-7130601-0
Create hunting rule

Win.Trojan.Gamarue-7133598-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Loki
Create hunting rule
Status:
Malicious
First seen:
2019-08-14 02:34:21 UTC
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
guloader
Create hunting rule
Similar samples:
04e5c465f8681e4304b463790bc5a91ba211275fcab82083289d2b2e66ad656e
AgentTesla
349c6730ddc5b8a6969dadbda237829f6cf52f57101ecb03adbb4024df5da299
AgentTesla
54d7bb96a72dc01cfc92a11805ecbd13d7e3c5b8f38bee450d164a5f19e7cef6
AgentTesla
647fee1c3bc734439133bd78fe6519ad349501ac7a83e179601950f97fe96e1f
AgentTesla
790fc0569800e0cf91c3b7bbd8517a2f5333960fdfa5714719c6e1e57d85f826
AgentTesla
a0a84ef378c8199a1b4511396d185b39d2dca86ffc608144f9d12f61d7d48cfd
AgentTesla
a30738760b8787a51d134470d53a01d3a970869a03e143514fdfa68ab6436fe6
AgentTesla
cb3ef534ec474c813d4f48ef09809eb874ff036b3f00122422da79f6e42c9f3c
AgentTesla
da995f78d6ba4f7acab4a421e759cc15d2a3b8ca5549edd76605252e410d65ac
AgentTesla
ec78b5ac660fc120e6ed5fe249e11c4258802c5062f6e410ee73344f2983181f
AgentTesla
+ 9'628 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_agent_tesla_g2
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>
Rule name:win_blackremote_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments