MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b72906cf963bcf4115a7d436a4768e76597524faf4a12f60fa42c2d59346b7bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b72906cf963bcf4115a7d436a4768e76597524faf4a12f60fa42c2d59346b7bb
SHA3-384 hash: f0ba76ce5f3768102c4047dff95aef04f5e8992c637977874fe8e33590d1fb18aafb4f1088473f759de0781b68bc6ecb
SHA1 hash: 49aa87d305ece528a8d646cf4ac9ae5885acd7ef
MD5 hash: 5e2a06348564cdc0d8c04ba0c86cf503
humanhash: lactose-lion-uranus-lamp
File name:1b26c7d11f2cd5a8edfc37cc0cc5854a.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:297'472 bytes
First seen:2020-03-30 15:04:42 UTC
Last seen:2020-04-08 12:44:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:tzHNRggCpg2SOUH+BBsMm/3rd0sAXYexFp9GZdvbVooeTV:x0lSVHuS3eTYQroeTV
Threatray 10'382 similar samples on MalwareBazaar
TLSH 7A543B7D6B88BA02F73D59328AD1566012F1D4834D23CB0F6EC45FED7E527CA298A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://onedrive.live.com/download?cid=FEDBE7305E742A3E&resid=FEDBE7305E742A3E%21134&authkey=ABovb6-1dZlzbfw

Intelligence

File Origin
# of uploads :
3
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 15:39:11 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4uqnt4whphucfnh2q3ki5uoozmxkjh26sqs6yh2ilbnle2gw65q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
077f75ef7fdb1663e70c33e20d8d7c4383fa13fd95517fab8023fce526bf3a25
AgentTesla
0cf4378a60635fbed046a2afa593ac87c02b814cb0f2760fcf475d2abedfb12a
AgentTesla
0f2ed94f7ce73623cc14daf630cd853c2618b09543688d15bf63e735564b1da8
AgentTesla
6987e9d66b3d7120047b8725caa87c262f1430a2b91a6d1ef717e6f4b6c3fd84
AgentTesla
8501b62ef01d0a8ffacb3e1c7bd13129fca8a621d00f14d81a1227cf6872c5fe
AgentTesla
8f9706ae3291a23f41bcdc0b9248389d39480087c2394cc249d45f30619441c6
AgentTesla
9f7264f096d9aa3d9bc1215a0979566e9fdc64dd58089c7913af18e2709e3f60
AgentTesla
a93c824d20b6d30f7a6cdd41e83dc2ed1b1294c023d25184b2779cd0fd4f2a5a
AgentTesla
e4cf16d4a0d4871fab22511f073c0cf293b9863a06d0fc733a9cb984c37c8886
AgentTesla
f9f31397ba8280e1f9b561cbead3a1d3c96eb95b42b492274b3d5804cc84d9b0
AgentTesla
+ 10'372 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

1289542b9d761921abfbfdea346a8ce2e9a2e3bb04547a42efa632275ddf4210

AgentTesla

Executable exe b72906cf963bcf4115a7d436a4768e76597524faf4a12f60fa42c2d59346b7bb

(this sample)

  
Dropped by
MD5 1b26c7d11f2cd5a8edfc37cc0cc5854a
  
Dropped by
MD5 85d70243b07aabad8d4fbb09108dbe7c
  
Dropped by
GuLoader
  
Dropped by
SHA256 1289542b9d761921abfbfdea346a8ce2e9a2e3bb04547a42efa632275ddf4210
  
Dropped by
SHA256 9e6e5d724792110f233262f28d19a8600bb86d15a4e1db0964fa3ecc428a97df
  
URLhaus
https://urlhaus.abuse.ch/url/332641/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments