MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a215c693d52db997e4a64d302f976d4bccac373250c5c29650fe199d86e6db62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a215c693d52db997e4a64d302f976d4bccac373250c5c29650fe199d86e6db62
SHA3-384 hash: dc94bdff1dd97e9e11ac680a2a834c1c094d2e675a12c5f3d541c402235ffbe864e4f9f10aac00cf1144bf0616f6a25f
SHA1 hash: 823d8b6c7b2196bd183d7743b58985b52f8ef6c1
MD5 hash: b7e327ae0b95aed18c5e678f0af02985
humanhash: don-october-one-whiskey
File name:10a409fcf9f5d524b1cbbf456f8eb0ee.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'984 bytes
First seen:2020-03-26 15:27:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:N3p1g/sXflE6pHWRK13utZWWHeLif22AoNQQYAtiVeISb4b4oSTV:9CsXflEEuKAWseLieMFlloSTV
Threatray 10'621 similar samples on MalwareBazaar
TLSH 6C54397C2B48B902F63D5D3349E1266052F290875E12CB4F7EC85FFC7A567CA290A396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1DOyWqA1NxV-oaC2RcObBiGV_4Wa-ZKiy

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-26 15:36:20 UTC
File Type:
PE (.Net Exe)
AV detection:
25 of 30 (83.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uik4ne6vfw4zpzfgjuyc7f3njpgkynzskdc4ffsq7ymz3bxg3nra._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
206245d53bb82c709f63b0544db47e0ba5a9822520e332ff818f481f8415f228
AgentTesla
27bd6b90b0679826263d4555f66bfc6d153c46538b5fff3a23cf31f03ef2c1a3
AgentTesla
2c9caf997f04e5e500275f4660f1a9d629db8a8496629955afa159a614c5f74b
AgentTesla
384f36ad8c67b24aab276a4b5c295cc0b2f690ca97d9ba854bce80b8f1e2031d
AgentTesla
4004e92d628057aa94eda2267826d3a4b15e6a72744d02225bdbc849fe5ce23f
AgentTesla
73dc86ee57793216e08fdd43cf42a086245e9d0980b741d62263196295d06bd5
AgentTesla
8bb885f9c9c6d765926f549592bddb567c2075b9c3e92334200af63f64be1485
AgentTesla
8f9706ae3291a23f41bcdc0b9248389d39480087c2394cc249d45f30619441c6
AgentTesla
db835b1d8c0cb244f0ee4acc8aa757beab527b257756fa7ff17b2847388545c5
AgentTesla
fc5c1b1b5ea0f43d529c28711f09ae39010969e2af69905ddb8ad294158d57c7
AgentTesla
+ 10'611 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

3f30680fa4b8787ed389074b806bbf00d16a9c09ff5f04149479efe1a7f3ca42

AgentTesla

Executable exe a215c693d52db997e4a64d302f976d4bccac373250c5c29650fe199d86e6db62

(this sample)

  
Dropped by
MD5 10a409fcf9f5d524b1cbbf456f8eb0ee
  
Dropped by
MD5 2b013eb59952fe4b5960149be430b7a4
  
Dropped by
GuLoader
  
Dropped by
SHA256 3f30680fa4b8787ed389074b806bbf00d16a9c09ff5f04149479efe1a7f3ca42
  
Dropped by
SHA256 447e2e0431cd832bbd579e0165236435eea906f1184f886f8b77b35f79c5d1a1
  
URLhaus
https://urlhaus.abuse.ch/url/328743/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments