MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d7bcb3e5e8b056065387eef6d1a9267965ed0b013ef8fb8140b4127cd8f16e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d7bcb3e5e8b056065387eef6d1a9267965ed0b013ef8fb8140b4127cd8f16e8
SHA3-384 hash: 82cdfa6f6801620196457ca7370fb04c0d4ba6c60bb2c3797491e335be14a842da228c1da3833471f6fee8246854730b
SHA1 hash: d388fb65184d8f0785e65b190eadfd5ed0d63599
MD5 hash: 6ad85c86e8f32bfaee3c611410ba5b0e
humanhash: oklahoma-foxtrot-india-sierra
File name:312e441eee91ff7be1f4a4f3e9cce5d4.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:300'032 bytes
First seen:2020-03-31 05:50:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 6144:T/hXsRx40JaId2gzamErRVwsnPkSZjdzWDEdFP14edtM5bcloST7:T/hXs8gsf1nPNdfdZoST7
Threatray 10'559 similar samples on MalwareBazaar
TLSH 7154297C2F88B902F73D5D3289D1667012F295934D22CB0F6EC41EEDBE527C9295A386
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://bondbuild.com.sg/wp-includes/SELFRANK_encrypted_D2F34AF.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-03-31 06:35:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tv54wps6rmcwazjyp3xw2gusm6lf5ufqcpxy7oaubnasptmpc3ua._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0dad541bfb58986d8e53cf1ebb05c9eced195bc4971283098f8459670545682f
AgentTesla
123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610
AgentTesla
2f3b7dd3632d2dc0037eab330830f33c2608b363049864db3af11f4fb29e9b9c
AgentTesla
36f23217058d61b401b63cfe41e8a7ccc1f5525a3f6b0c57800fda8403429fb6
AgentTesla
3e49a3d5e53c479d5da50528b7d62df675d22baa97198cc1ba50ea0f40bdd2e7
AgentTesla
4d9a1d631dce49d1e7e5eddc38dfb09be7bc1386a2f28182ac88af51bced96d0
AgentTesla
9a8948340515796c4fe204849492d03184034350e2e28c1e34beba51a9b960cc
AgentTesla
d019817ea685d2263a332bd4dd3b95ea750ce42f0834ea7c6464c2b7328b8ed8
AgentTesla
dedf36514df689bf45199f4637020acf6f800ccdca2f8558b96973ed6298b72b
AgentTesla
dfca8cf09994229afec678b5c279d247e3e69c45f2878f816025b4933f3bc3b0
AgentTesla
+ 10'549 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

f8aaa27a54e205f270e2857b33668b95606c95ea003453b9c69b76076b436219

AgentTesla

Executable exe 9d7bcb3e5e8b056065387eef6d1a9267965ed0b013ef8fb8140b4127cd8f16e8

(this sample)

  
Dropped by
MD5 312e441eee91ff7be1f4a4f3e9cce5d4
  
Dropped by
MD5 5cd8706c2e05c885db97d137800d8fa9
  
Dropped by
GuLoader
  
Dropped by
SHA256 f8aaa27a54e205f270e2857b33668b95606c95ea003453b9c69b76076b436219
  
Dropped by
SHA256 0c15bfe660b7a30e6d4d8434785b47b9109d78f52ee6893cfe474c34ab682035
  
URLhaus
https://urlhaus.abuse.ch/url/332636/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments