MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b47aab8ce39fe049703a6c4ca51148dfc127550af59fe80d392b7203bf969c44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b47aab8ce39fe049703a6c4ca51148dfc127550af59fe80d392b7203bf969c44
SHA3-384 hash: 22953adb1f33cbf795e2d7628461822291942e4bf095fed3bb011a8b0b7306c3de3d3400db3d12245b5f0369607e5e23
SHA1 hash: 8248a28993769a7c9dee54997cf4f8e7bed05b50
MD5 hash: 49671db82e25d9305b7d3f1862c55423
humanhash: eighteen-floor-early-montana
File name:f286a647b1de2778cbeebba05513e6c4.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:293'888 bytes
First seen:2020-04-22 11:30:46 UTC
Last seen:2020-04-22 11:45:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 6144:Po2nOIxX88/A4le++pGdLZ4Hg7bWOgNu1umb7Oo:PfxXA2eqxt7bWOgWOo
Threatray 10'699 similar samples on MalwareBazaar
TLSH F4543ABD2B98B902F23D493685D1122453F1D0839D22C34F6FC44FE97F697DA294A396
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://mfpc.org.my//wp-content/plugins/formcraft3/STUB2_encrypted_BA9409F.bin

Intelligence

File Origin
# of uploads :
7
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-7683554-0
Create hunting rule

Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 16:55:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wr5kxdhdt7qes4b2nrgkkeki37asovik6wp6qdjzfnzahp4wtrca._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0702729c34578ee78cf3cb883ee298fc4aa67dbb433981790605e4e4afb642ff
AgentTesla
0fabbaf7f8ad7af3888aa77b2e376db74390064ea8eea0c54fee59fdc2cd54c8
AgentTesla
1e68055f95563948fbacfd1de0b04fd457c108ef8482d2a6642a0067835ce529
AgentTesla
488e6c7d2c8bdb10b52731aea5977f0a37de634ba0ceb90280fc13b097ced830
AgentTesla
5d3982d550914c9c8c902f6fa337fe605d16ada1ee0205e9f0d7194245abc88c
AgentTesla
75be5572f50de83344879aecb5b2b30bb462afc6c7120b131a2efef657a2c8d9
AgentTesla
826c58de5e811796f7b77ea72b19c0e5bb61d08b51c08ad4277820eea897a613
AgentTesla
a5ac47c41bd2ab3f8867c857c379044474fb5b2874f75273d58c1ab5b42a0ea5
AgentTesla
d6e3f0da64e49d6752ac11f1ad3af3adc797901acfe2d00411d4d05b613053fb
AgentTesla
f75d8637bf5e657cbd18bbeebb6dfee8aac3734021efc1334112c3dc78591d50
AgentTesla
+ 10'689 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

432d7af31f89d21ff3494c1edff3a71b0533a417d5c7d352b6a7c0165fa07166

AgentTesla

Executable exe b47aab8ce39fe049703a6c4ca51148dfc127550af59fe80d392b7203bf969c44

(this sample)

  
Dropped by
MD5 f286a647b1de2778cbeebba05513e6c4
  
Dropped by
MD5 4fefbf9527640a5e8a2922b55e1c584b
  
Dropped by
GuLoader
  
Dropped by
SHA256 432d7af31f89d21ff3494c1edff3a71b0533a417d5c7d352b6a7c0165fa07166
  
Dropped by
SHA256 ce1da7d0077cf8021472745ac602992bf6f8ad904c6afd8edb176b25054ff5c6
  
URLhaus
https://urlhaus.abuse.ch/url/348601/
  
URLhaus
https://urlhaus.abuse.ch/url/349089/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments