MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5d29ef21b96f57e29e87c97aea1de7e8a91fdc2e706bb648c6c7c490c7f7ea0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5d29ef21b96f57e29e87c97aea1de7e8a91fdc2e706bb648c6c7c490c7f7ea0
SHA3-384 hash: eafe0d4421f70a2b55ab233a4d17a59a60170fddd60e84946481c473158b50f1e7bd4580ffeff9f7850aa809cb46df0c
SHA1 hash: fa8cae764f8a39faa4bba81cf4019756b4a5c772
MD5 hash: 6dfd682f616672a91c4a019757becb55
humanhash: butter-maryland-bravo-leopard
File name:d7b07a881f346c4690d7bd2f25b0a273.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:298'496 bytes
First seen:2020-03-27 04:10:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'855 x AgentTesla, 19'783 x Formbook, 12'304 x SnakeKeylogger)
ssdeep 6144:tEYY3RQlHCu4/Rf4tc61FSTXmAInZ9GLlbpoaTl:tE1Bg4/53nXPoaTl
Threatray 10'391 similar samples on MalwareBazaar
TLSH 21543A7C6B88B902F73E593289D1567022F2D4874D13CB0F6EC45FED7A52BCA284A395
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
http://185.242.104.78/wftp/ekeneeee_encrypted_C1E13FF.bin

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-27 04:35:33 UTC
File Type:
PE (.Net Exe)
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxjj54q3s32x4kpipsl25io6p2fjd7oc44dlwzemnr6esdd7p2qa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
29fabe5df6990ee68cfc1a5b8bdbb07d2bdd2a19a1d2b952706637d0b12e8cbd
AgentTesla
2aa68bc3a8867dbb9b3204abeb00bb43e44219859bcf79b2beb258f1d447e537
AgentTesla
68489df213a73f1422b497da630067e152d62516ac535d87a8235e66dc8706cf
AgentTesla
7399fc107327a8ecb09632fd6380f18e3f7c382675b9be0a2613beb831337096
AgentTesla
8ed339f943c618ed7d55ff92dcad7ee68dcc02753691838fdecb06db6a8e1202
AgentTesla
b265a179bab6fe80bb3b81544e3f04e285a7b90b17e01bc34881e502aa5bb489
AgentTesla
b37c51cf38539f8c9f85b9179f2430cf0b42cce76340ff662121b28da47418d2
AgentTesla
bf5ea94f9caf0f0db89ebbab1b2d022be6381423eee08d35afd2e14b465ea840
AgentTesla
cc2666dac9601a3ed925c31a2630a8b1278cc12443ce7a962bab57db4d5541b3
AgentTesla
cdb6f3c91b806fb8c754495fb7fc0600403be90c872122564771f181b611ccec
AgentTesla
+ 10'381 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

03ab2c1f86039b5e6ce21ade88e1b474c8d10dcbe510debf1eb463c2dc39be78

AgentTesla

Executable exe a5d29ef21b96f57e29e87c97aea1de7e8a91fdc2e706bb648c6c7c490c7f7ea0

(this sample)

  
Dropped by
MD5 d7b07a881f346c4690d7bd2f25b0a273
  
Dropped by
MD5 6a68b423746529491aae9c44ec09118c
  
Dropped by
GuLoader
  
Dropped by
SHA256 03ab2c1f86039b5e6ce21ade88e1b474c8d10dcbe510debf1eb463c2dc39be78
  
Dropped by
SHA256 59cccd461943d5e77b63666da5ec1d4893c1e7053fa07bcf720b63a3f7d23e03
  
URLhaus
https://urlhaus.abuse.ch/url/330815/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments