MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2916832bcfec5ab78ce54df726a01123f8ecea355b8832cf37daf281d66f524. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2916832bcfec5ab78ce54df726a01123f8ecea355b8832cf37daf281d66f524
SHA3-384 hash: ce4864b2bc3032fcc22beb28ff47ceb8927cd3fbb7209f44e3877fbb71c83aa6ea08b0ebe8650ca3c576e8e34c1f3666
SHA1 hash: 3133701e9fb405d29333b503a39238a7dc36d35f
MD5 hash: 93b336eb57cde4abef4352ede4eedcc8
humanhash: charlie-early-north-oklahoma
File name:4384f349314757b8280e636513479823.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'008 bytes
First seen:2020-03-30 03:10:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:7yyigD4IdE82ou+s5XBfIX7IbU3KlV6V1+LoXGtXkWedFSb+zouT7:7yyis9cU3Y6PMXkzjouT7
Threatray 10'428 similar samples on MalwareBazaar
TLSH 96543A7D2B88B902F73D5D3289E1666022F194874E12CB0F6EC51BED7F5B7C9284A385
Reporter abuse_ch
Tags:AgentTesla exe GuLoader


Avatar
abuse_ch
Payload dropped by GuLoader from the following URL:
https://drive.google.com/uc?export=download&id=1Qn1AQ6R_pqqZ_7VZds3RoBmgNnowzW4Z

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7426372-1
Create hunting rule

Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-03-30 03:35:26 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
23 of 30 (76.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykiwqmv473c2w6goktpxe2qbci7y5tvdkw4iglhtpwxsqhlg6usa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
123bd24a2bd246b8fe7eec432072912a53acf73b0db15ebb98b0962d4b54e610
AgentTesla
143b4a41585c0993a01c538de2f439c5a6fbeaae30b9709e067c838b39a4f468
AgentTesla
3e49a3d5e53c479d5da50528b7d62df675d22baa97198cc1ba50ea0f40bdd2e7
AgentTesla
4976bb0acc6b6e5901a2b61f85c82e905b4d13c811ec83eb74cc7c300d14b382
AgentTesla
79a6cd0ad542c43bd3b6c3baebe42c7682ad82294ad70a89624c13a9082f1f2b
AgentTesla
976174c0ffcfd0cdeea0a9dd962b995142d15a1cc831a42c68e7b3f928bd7c3a
AgentTesla
98489349a1120f5719ca1ec3d9e10c4f35edfc75944d15f050017c8c3fe2520e
AgentTesla
c4fc5587f9e3741efbd7aca1ef0a1b2471da6c62a02901b9929ac7239e6fd04c
AgentTesla
efad28e77822049d1d0c699c9b8531df0d053f57a332b7f7b1618e82e9f7484e
AgentTesla
fa52701034f5b40937afd001f26baf9a19b21cf44c5eb6f35f3b8afb41865efe
AgentTesla
+ 10'418 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

GuLoader

Executable exe aa3420190b3e22959cfb4715307027404fe5cb492faf5546189a20b82b9e4e37

AgentTesla

Executable exe c2916832bcfec5ab78ce54df726a01123f8ecea355b8832cf37daf281d66f524

(this sample)

  
Dropped by
MD5 4384f349314757b8280e636513479823
  
Dropped by
MD5 59a91b553cd2846146b3c885b5b7fcbf
  
Dropped by
GuLoader
  
Dropped by
SHA256 aa3420190b3e22959cfb4715307027404fe5cb492faf5546189a20b82b9e4e37
  
Dropped by
SHA256 27e7f990d0e6162c81d96ed8218dea778609e26b6b8464df24b79852b8e829d7
  
URLhaus
https://urlhaus.abuse.ch/url/332088/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments